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ABSTRACT 


This thesis presents the methodology for a detailed 
vulnerability assessment of a generic aircraft in the con- 
ceptual/preliminary design stage. The single hit vulner- 
ability of the aircraft to a 100 grain fragment is 
determined using the textbook, The Fundamentals of Aircraft 
Combat Survivability Analysis and Design. The intent of 
this work is to provide a realistic case study of a 
vulnerability assessment that can be used by others as a 


learning tool. 
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I. INTRODUCTION 


"The survivability of an aircraft operating in an enemy 
threat environment depends on its design and on the 
emphasis “по: on its survivability throughout its life 
cycle. The cost of modern aircraft weapons systems, the 
aircraft and personnel attrition experienced m recent 
combat, and the resulting loss of operational capability 
make survivability enhancement imperative." This paragraph 
is in the forward of MILITARY STANDARD 2069/AS (MILSTD 
2069), Requirements for Aircraft Non-Nuclear Survivability 
Programs [Ref. 1:р. iii]. This document establishes the 
guidelines between the contractor and the Department of 
Defense (DoD) regarding survivability design in major 
weapons systems. Its primary thrust is that survivability 
must be a design requirement, one that is incorporated and 
implemented from the conceptual design phase through the 
total life cycle of a major weapons system. 

The survivability design discipline has only recently 
become a major factor in weapons acquisition. Dr. R.E. 
Ball, Professor of Aeronautics at the Naval Postgraduate 
School (NPS) in Monterey, California recognized the 
importance of aircraft survivability in a hostile threat 
environment more than ten years ago. What began as a set 


of notes for a course taught at NPS has evolved into The 


10 


Fundamentals of Aircraft Combat Survivability Analysis and 
Design [Ref. 2]; the first textbook that fully examines the 
total survivability picture from both the design and 
analysis points of view. Dr. Ball's book is the basis for 
the following case study in the vulnerability of an 
aircraft in the conceptual/preliminary design phase. 

The author, following the words of Dr. Ball 
(Ref. 2:p. 11], "survivability must seriously be consid- 
ered by everyone during the early design phase of the 
aircraft"; chose to do a vulnerability analysis of an 
aircraft of his own design. This aircraft was designed to 
fulfill the requirements of AE-4273, Aircraft Conceptual 
Design, a graduate level aeronautics course taught at the 
Naval Postgraduate School. 

The course material is based on a seminar in conceptual 
design given by Mr. D.P. Raymer of Rockwell International. 
The course develops the aircraft design based on a given, 
generic Request For Proposal (RFP) for an attack aircraft. 
The aircraft was developed using historical data, "rules of 
thumb", current aeronautics trends, and regression equa- 
tions. The component layouts and structural arrangements 
were conceived by the author using current tactical 
aircraft designs as guidelines. The resulting conceptual 
design was then analyzed with respect to aeronautical and 
operational capabilities. Lift curves, drag polars, 


weights, and other performance parameters were determined 


DE 


to establish compliance with the requirements set forth by 
the RFP. | 

The author's design represents a generic aircraft, one 
in which the systems, structures, capabilities, and 
performance are unclassified. By conducting a vulnerabil- 
ity assessment of this generic, conceptual design, the 
author hopes to obtain the widest dissemination of this 
critical design consideration. 

Prior to discussion of this topic, it should be stated 
that this case study is based soley on the methodology 
presented by Ball [Ref. 2]. The author assumes the reader 
is very familiar with this methodology, or has the ref- 
erence readily available. The specifics of Dr. Ball's book 
will not be repeated here, the reader is left to refer to 
the text as necessary for any background clarification. Іп 
each succeeding chapter, references are made to pages, 
figures, etc., to assist the reader. (Although the author 
feels that this case study could stand alone to someone 
intimately familiar with aircraft combat survivability, the 
language and methods of this engineering discipline are 
somewhat unique and further guidance and reference is 


sometimes very helpful.) 
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ТТ. CONCEPTUAL DESIGN OVERVIEW 


The acquisition process for a major weapons system is a 
lengthy and costly one. From initial analysis to full 
scale production, the time period may span ten or more 
years. It is imperative that everything possible is done 
to ensure that the system is the most "effective" one that 
industry and the government can produce. 

Department of Defense Instruction 5000.2 (DoDINST 
5000.2) [Ref. 3] is the primary guideline for the Major 
System Acquisition Process. Figure 2.1 [Ref. 4:p. ICD-1] 
shows the tasks and Milestones that must be met in order to 
satisfy all of the DoD requirements for the production of a 
major system. Figure 2.2 [Ref. 4:p. ICD-2] presents the 
different acquisition cycle interrelationships that are 
conducted simultaneously in order to meet the Milestones 
required by DoDINST 5000.2 [Ref. 3]. The conceptual/pre- 
liminary design phase activities are required to be com- 
pleted between Milestones O and 1. 

By the time Milestone 0 has been completed, the 
following has been accomplished with regard to system 
qevelopment: 

1. A threat has been identified and a system to counter 
the threat has been proposed. The Defense Intelli- 
gence Agency has validated the threat and made the 


DoD aware of the shortfalls of existing systems in 
meeting the threat. 
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Figure 2.1 
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2. The Department of Defense responds with a Request 
For Information (RFI) to the defense industry. This 
is a document soliciting concepts for the system the 
DoD feels it needs to counter the expected threat. 
The RFI will specify the ройшааву conditions to be 
looked at in the early development of the systen, 
such as survivability, logistics, costs, standardi- 
zation to existing systems, etc.. Industry in turn, 
responds to the DOD's requirements with an estima- 
tion of the technological feasibility of building 
the system to fulfill its intended use. This system 
is based on historical data, engineering trends, and 
future hardware capability estimates. 

3. DoD looks at industry's response, and if satisfied, 
requests a Justification of Major Systems New Start, 
or JMSNS. "Here, approval from the Secretary of 
Defense is required to continue research and develop- 
ment into the new system. Once that approval is 
received, Milestone O has been met. 

After Milestone O has been met, DoD once again makes a 
request to industry to submit ideas or proposals for the 
new weapons system. The Request for Proposal (RFP) is used 
by the industry to develop its conceptual systems design. 
The time period between Milestone 0 and Milestone 1 is 
usually two to three years as shown in Figure 2.1. The RFP 
is much more detailed and specific in its guidelines than 
the RFI. It relays to industry specifically what the 
weapons system must be capable of doing to eliminate the 
expected threat. It provides guidelines with regards to 
categories such as aerodynamics, performance, size, weight, 
mission, weapons/armament, carrier suitability/field 
performance, survivability and crew considerations. 


Industry then uses this document as the baseline data for 


its conceptual/ preliminary designs. The generic design 
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process is shown in Figure 2.3. This table breaks down the 
design process into three phases of development. For the 
purpose of this case study, the aircraft design is’ assumed 
to be between phases two and three of the design process. 

The importance of a survivability assessment in the 
conceptual/preliminary design phase cannot be over- 
emphasized. As seen in Figure 2.3, each phase of the 
design process requires a corresponding survivability 
analysis. It is a requirement that is noted in every 
guideline to contractors for major weapons systems. For 
example, MILSTD 2069 [Ref. l:p. 1] states: 

"A standard must be developed in the early stages of 
major systems acquisition. A survivability assessment 
program is to be included in each contractural work 
Statement. The purpose of this is to require studies, 
threat definitions, and contractural trade-offs to allow 
contractors to propose conceptual or notational designs 
which will meet combat survivability demands and generate 
data upon which firm design requirements will be based 
for full scale engineering development." 

From an economic standpoint alone, the government 
should demand conceptual trade-off studies using surviv- 
ability assessment methodology. It is much easier, and 
much more cost effective, to change a design while in the 
"baper phase", than to attempt to modify an existing air- 
frame. The assessment in the conceptual/preliminary phase 


provides an opportunity to examine the effects of changes 


in the parameters and the design. How these changes 
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affect the aircraft's survivability, performance, tactics, 
maintainability, reliability, armament and cost can be 
evaluated and assessed with regards to the benefits and 
penalties. The following chapter will introduce the 
Survivability program and the steps necessary for its 


implementation and completion. 
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ІІІ.  БОБМІУАВІРТ ВУ PROGRAM TOV TEW 


The contractor for a major weapons system must 
establish a DoD approved Survivability Program and inte- 
grate it into the company's management system. Ball [Ref. 
2:p. 34], states: 

"To develop a survivable, cost-effective aircraft 
requires a systematic survivability program beginning in 
the conceptual phase and continuing throughout the life 
cycle of the aircraft. It is essential that surviva- 
bility criteria be established early in the conceptual 
phase and that alternative designs and utilization 
solutions be developed. By developing this information 
before the final design configuration is established, 


the most cost effective survivability enhancement 
techniques can be identified." 


MILSTD 2069, Requirements for Aircraft Non-Nuclear 
Survivability Programs [ВеЁ. 1], 1$ the standard the DoD 
uses to provide uniform res. а and guidelines for 
establishing survivability programs. Figure 3.1 [Ref. lip. 
2] shows the life cycle of a typical survivability progran. 
It shows that survivability is a continuous process that 
begins in the initiation phase and continues throughout the 
life cycle of a weapons system. 

The survivability of an aircraft is related to two 
fundamental attributes, susceptibility and vulnerability. 
The susceptibility of an aircraft can be defined as the 
inability of the aircraft to avoid being hit while 


conducting its mission. It is dependent upon how well the 
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enemy is able to detect, identify, track, acquire, and hit 
the aircraft as a target. The vulnerability of an aircraft 
is the measure of how much the system or systems are 
degraded due to the hit by the damage causing mechanisms. 
A survivability program is concerned with all the design 
factors that influence the aircraft's susceptibility and 
vulnerability. 

MILSTD 2069 [Ref. l:pp. 12-25] defines the following 
tasks that must be included in a survivability program: 


Mission Threat Analysis 

Aircraft Geometric Configuration 

Flight and Mission Essential Functions 
Identification 

Fallure Mode, Effects, and Criticality Analysis 
Aircraft Vulnerability Assessment 

Aircraft Susceptibility Assessment 
Aircraft Survivability Assessment 
System/Cost Effective Analysis 
Survivability Enhancement Trade-Off Studies 
0. Combat Damage Repair Assessment 


шо № 


ЊУ VO OO +.] O) Q 


Most of these tasks will be explained in a general manner 
according to MILSTD 2069 [Ref. 1]. Then, in subsequent 
chapters, the first five tasks will be accomplished using 


the generic aircraft. 


A. MISSION THREAT ANALYSIS 

The missions of the aircraft and the expected threat 
systems are expressed in the DoD generated specifications 
such as the RFI and RFP. The expected flight profiles and 
defense situations that the DoD has identified are used to 


develop designs and conduct trade-off studies. 
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The contractor attempts to define each operational mode 
in terms of aircraft performance, weights, armament, etc., 
to meet the expected threat scenario that has been given as 
the basis for"the design. Encounter conditions should be 
determined and used as the basis for survivability design 
and trade-off studies. These studies are used to ensure 
the aircraft can operate effectively in the threat environ- 
ment. It is important to identify all possible threats the 
aircraft may encounter during a mission. If the aircraft 
issGapable of a multifunction role, then the expected 
threats will vary according to the situation and the envi- 
ronment the aircraft is in. 

Recording to Ball (Ref 2'p. 115), the Mission Threat 
Analysis can be divided into three phases: 

(1) Define the mission and the flight envelopes of the 
aircraft. This will encompass operating environ- 
ments, mission types and flight conditions. 

(2) Define the expected threat environment for each 
mission and theater. Here the enemy systems are 
analyzed to determine their envelopes. 

(3) Combine the data gathered in the first two phases. 
Estimate the likelihood of encounter between the 
aircraft and each threat system, and identify the 
conditions of each at the time of encounter. 

pw Pp CRAFPT GEOMETRICUVDESCRIPTION 
The aircraft geometric description is the development 


of a detailed, accurate description of the aircraft for use 


in the vulnerability analysis. For an aircraft in the 


Zo 


conceptual/preliminary design phase, as much technical and 
functional data as possible must be collected on each major 
—— of the aircraft. This data should include, but need 
not be limited to: 


engineering drawings 

trade-off study results 

3-view scale drawings 

narrative descriptions of the proposed systems 
block diagrams 

flow charts 

projected performance data 

cross section drawings 


Ono mf WN з 


For an aircraft currently in the inventory, its NATOPS and 
MIMS could be added to this list to provide a thorough des- 
cription of the aircraft, its systems and operating capa- 
bilities. 

For aircraft being analyzed using current computer 
programs for single hit vulnerability (see Ball [Ref. 2:p. 
192-198]), this collected data is used to generate a geo- 
metric model and descriptor of the aircraft and its 
systems. This model is then used with the computer pro- 
grams to develop vulnerability indices for the aircraft. 


Such a task is beyond the scope of this case study. 


C. FLIGHT AND MISSION ESSENTIAL FUNCTIONS 

Using the missions defined by the DOD, the contractor 
must determine the flight and mission essential functions 
for each mission phase. A flight essential function is 


that function performed by one or more components on the 
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сшывае шар permits the aircraft to sustain flight 
cnrough adequate litt, tnrusü ara weentrol. 

A mission essential function is a function performed by 
one or more components on the aircraft that permits it to 
accomplish its defined mission. For example, the weapons 
delivery system of an attack aircraft is not a mission es- 
sential function during the take-off, climb-out or cruise 
phases of a flight. But it is definitely a mission essen- 
tial function during an ordnance delivery run on a desig- 


nated target. 


D. FAILURE MODE, EFFECTS, AND CRITICALITY ANALYSIS (FMECA) 

The Failure Mode, Effects, and Criticality Analysis 
(FMECA) is a multidiscipline design procedure, utilizing 
design inputs such as system reliability, maintainability, 
and safety to define the response of the aircraft and its 
systems to damage caused by the damage mechanisms. As 
such, it is one of the most important parts of the vul- 
nerability assessment. The ultimate goal of this analysis 
is to identify the aircraft's critical components. A 
critical component is defined as one whose damage or loss 
could lead to an attrition level or mission abort level 
Kili, 

Utilized in the conceptual design phase, MILSTD 2069 


[Ref. 1:p. 13], defines the FMECA as a procedure that: 
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(1) Documents all possible potential failures for each 
component or subsystem. 


(2) Determines by prediction and analysis the effect of 
each of the failures on system operation. 


(3) Identifies potential failures critical to personnel 
safety. 


(4) Ranks each failure according to effect severity. 
The FMECA procedure is performed in two steps, (1) a Fail- 
ure Mode and Effects Analysis (FMEA) and (2) a Damage Mode 
and Effects Analysis (DMEA). Another analysis tool,not 
formally required by MILSTD 2069 is the Fault Tree Analysis 
(FTA). This can be used in addition to, or in place of, an 
FMEA if one is not available. 

1. Failure Mode and Effects Analysis (FMEA) 

Figure 3.2 (Ref. l:p. 15] shows the role of the 
FMECA in the overall vulnerability assessment. In the FMEA 
phase: 

(1) The contractor must identify, to the best of his 

theoretical and analytical ability, all possible 


failures and their effects#on the airerare. 


(2) Each critical component is identified and its 
functions defined. 


(3) All possible failures of the component are examin- 
ed, including those due to its location within the 
aircraft. 


(4) The results of these failures must be related to 
the components own functional ability and also to 
the functional abilities of the system from which 
that component is a part. This in turn, is related 
to effects of component damage in the overall 
aircraft. 
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Figure 3.2 
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The major input to the FMEA is the physical and 
functional description of the aircraft and its systems, 
components, etc.. This information is the Aircraft 
Geometric Description as discussed earlier. The output of 
the FMEA is usually in the format of a self-explanatory 
table or matrix (Figure 3.3) [Ret. 2:5. 142]. The 
contractor must be as specific as possible to the current 
level of design. For the conceptual/preliminary level, 
major systems and some basic components can be broken down 
into sufficient detail to provide a thorough analysis. In 
later stages, the actual "nuts and bolts" of the components 
are examined for possible failure modes. 

2. Damage Mode and Effects Analysis (DMEA) 

The second part of the FMECA, the DMEA, is NT 
to and dependent upon predicted damage from exposure to the 
combat environment. The contractor must assess the com- 
ponent's potential failures due to the damage mechanisms, 
relate these failures to the kill level required in the 
assessment, and quantify the component's ability to 
continue to operate in the hostile environment. 

The kill level referred to in the previous 
paragraph can be any one of three categories of aircraft 
Kill that measure the degree to which the aircraft suffers 
performance degradation. These categories are attrition 
kill, mission abort kill and forced landing kill. The 


attrition kill is the one most commonly analyzed, and 
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is a measure of the severity of aircraft damage that causes 
it to be lost from the inventory. Time is the most 
important parameter in the attrition kill, therefore it is 
the basis for the four levels of attrition kill. These 
levels are: 


1. KK kill: Damage that will cause an aircraft to dis- 
integrate immediately upon being hit. 


2. K kill: Damage that causes an aircraft to fall out 
of manned control within 30 seconds after being hit. 


3. A kill: Damage that causes an aircraft to fall out 
"ОБЕ manned control within 5 minutes after being hit. 


4. B kill: Damage that causes an aircraft to fall out 
of manned control 30 minutes after being hit. 


The A level or 5 minute attrition kill is the kill level 
usually used by DoD and industry to evaluate the vulner- 
ability of an aircraft. The A level attrition will also be 
used for this case study. 

The DMEA relies heavily on information gained from 
a correct and thorough FMEA. The DMEA also identifies any 
secondary damage caused by the primary damage mechanism. 
For example, a secondary fire caused by the detonation of 
an HEIT projectile inside the aircraft's structure. Ball 
[Ref. 2:p. 145] provides a table (Table 3.1) of the most 
important damage caused failure or kill modes of the major 
systems. Each system mentioned is broken down in the DMEA 
and analyzed to determine the lowest level of component 


failure. 
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Because the DMEA analyzes the criticality of fail- 
ure, the output from the study is more detailed and elab- 
orate than from an FMEA. The DoD will notify the 
contractor on the required DMEA data necessary for the 
particular weapons system being assessed. The depth of 
detail and breakdown will depend on which design phase the 
assessment takes place in. 

There are four sets of data which make up the DMEA 
output. The first set is the DMEA Matrix or Table (Figure 
3.4) [Ref. lip. 17]. The contractor must break down the 
aircraft systems to their component level; and relate these 
components and their failure modes to the probability of 
kill given a hit P(k/h) functions, kill level, and redun- 
dancy levels. In a conceptual/preliminary design phase, 
the contractor uses historical data and predicted engineer- 
ing specifications of materials and components to make this 
analysis. 

The second type of data produced from an DMEA is a 
Disablement Diagram. Figure 3.5 [Ref. 2:p. 144] is the 
graphical representation of the results of the FMEA and 
DMEA. The contractor uses the system design proposals and 
predicted survivability of each component to graphically 
illustrate the failures of the system to a specified kill 


level. 
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Тпе third set of data generated by a DMEA is the 
Pubes Tree or Kill Diagram. Тһе КҮПІ Гіаағала аге аеу- 
eloped by combining data from the Flight and Mission 
Essential Functions Analysis, FMEA, DMEA, Disablement 
Diagrams, and should include evaluation by members of the 
operational community and engineers responsible for the 
design of the aircraft. They are a function of kill level 
and graphically depict the combination of components and 
systems that must be sufficiently degraded to effect the 
particular kill level on the aircraft. 

The kill diagram is a visual illustration and iden- 
tification of the critical components of the aircraft and 
their redundancy relationships. It is constructed by the 
Бог сс ог for the aircraft in a specific flight condition. 
The example kill diagram shown in Figure 3.6 [Ref. 2:p. 
153] illustrates the effect of redundancy on a system. 

The last data source of the DMEA is the set of 
Шивораршіа су of kill, given’ aj hit" functions (P(K/h) . 
These functions, or values are assigned to a component 
based on its response to being impacted by a damage 
mechanism (fragment or projectile). The contractor 
normally uses government provided or specified Р(К/П) 
values where required. In a conceptual/preliminary design 
phase the contractor also uses historical data and 
available ballistic test data to ascertain the amount of 


damage the component will sustain. The Р(К/«П) 
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for each component requires sound engineering judgement and 
realistic design assessments. The functions can be expres- 
sed graphically as a function of damage mechanism mass and 
мелос у (Figure 3°77) (Ref. 22p. 156], or in analytical 
format. The contractor uses the P(k/h) functions for 
components that can be killed by a single shot and for 
larger systems such as engines which are divided into 
segments with specific P(k/h) values for each segment. 

3. Fault Tree Analysis (FTA) 

As previously mentioned, the Fault Tree Analysis is 
not required by MILSTD 2069 as a task in a survivability 
assessment. It is another method used to identify critical 
components. It usually conducted when there has been no 
FTA provided for the system under analysis. It can 
actually replace the FMEA and is done in parallel to the 
DMEA. 

Ball [Ref. 2:p. 149] calls this analysis the "top 
down" approach. An undesirable event is the catalyst for 
the Fault Tree Analysis, then the events or combination of 
events that caused the undesirable event are determined. 
The undesirable event for this case study is the A-level 
attrition kill. The contractor will analyze what could 
cause this event to occur; breaking down systems into their 
components and examining them for levels of redundancy, if 


any. As seen from Figure 3.8 [Ref. 2:p. 149], logic 
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symbology helps to branch the fault tree by recognizing 
component redundancy and the relationship between cause and 


effect. 


E. AIRCRAFT VULNERABILITY ASSESSMENT 

From a contraąactor's viewpoint MILSTO COCOR RS rT TRS 
very specific in its requirements concerning a vulner- 
ability assessment. The data and information discussed in 
the previous paragraphs is the backbone of any vulnerabil- 
ity assessment. In the conceptual/preliminary design 
phase, the contractor has the freedom to use either his own 
ог government approved methodology. Regardless of the 
methodology, it must meet the following objectives as set 
forth by MIEESTD 2069 (Ret. ТАБУЫ 


(1) Identify deficiencies and evaluate methods and 
design changes to reduce vulnerability. 


(2) Provide quantified measures of vulnerability for 
specific threats and kill levels for use in design 
analyses and trade-off studies. 


(3) Provide inputs for the survivability assessment of 
the aircraft. 


Vulnerability assessments can take various forms. The 
contractor may use detailed computer analyses with geo- 
metric models and various computer programs such as those 
mentioned by Ball [Ref. 2:pp. 192-198]. Because this 
aircraft is in the conceptual design phase, this method 


will not be used for this case study. 
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Тпе contractor must also do a detailed analysis for the 
aircraft's single hit vulnerable area using the P(k/h) 
ришесіспе for the components. According to Ball [Ref. 2:p. 
154], the vulnerable area is "a theoretical non-unique area 
presented to the threat, that if hit by a damage mechanisn, 
would result in an aircraft kill. 

The contractor may be required to develop a vulner- 
ability analysis based on the P(k/d), the "probability of 
kill given a detonation envelope" if the weapons system is 
expected to encounter HE warheads in its mission profile. 

Another area of vulnerability study is the laser 
threat. The P(1/o), " probability of kill given a specific 
laser power lock-on for a specified period of time. This 
is becoming extremely important with current technology 


development. 


БИРАТЕСЕКЕТ SUSCEPTIBILITY ASSESSMENT 

The contractor must utilize the results of the Mission 
Threat Analysis to conduct a proper susceptibility assess- 
ment. Since the susceptibility of an aircraft depends upon 
the mission scenario, the threat encountered, and the 
aircraft itself, a complete and thorough Mission Threat 
Analysis is essential. 

The contractor makes judgements and assessments based 
on the conceptual design, known or proposed tactics, 


aircraft designed performance, the characteristics of the 
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threat, its lethality, and the environment to assess how 
well an aircraft can avoid being damaged while performing 
its assigned mission. Or it can be stated that the 
contractor uses all weapons, aircraft, and environmental 
data to determine the net probability the aircraft is hit 
by the damage mechanism. 

There are several specific weapons and aircraft 
parameters that the contractor must consider when 
performing this assessment. 

(1) The threat parameters include: 

-detection 

-acquisition 

-lock en 

XC 

-missile guidance 

-gun fire control 

-command and control interfaces 
(2) The aircraft parameters include: 

-detectable signatures (IR, RCS, aural) 

-counter measures 

-tactics 

-flight path and performance 

The contractor must make trade-off studies, especially 
in the conceptual design phase, during a susceptibility 
assessment. For example, industry must weigh the advan- 
tages/penalties in weight and cost replacing conventional 
nozzles with 2-D nozzles to reduce the IR signature of an 
exhaust system. Or, adding a more powerful jammer based on 
the perceived threat, and fighting with the weight, cost 


and size parameters inherent in such a decision. There are 


many analytical processes involved in this type of 
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analysis; the contractor must document each analysis and 
passucesthe most efficient solutiom to the aircraft's 


susceptibility. 


G. AIRCRAFT SURVIVABILITY ASSESSMENT 

The Survivability Assesment is the capstone of the 
Survivability program. It is the culmination of a quan- 
titative measure of the aircraft's survivability. The 
contractor must combine the results of all of the above 
mentioned assessments and determine the effectiveness of 
the weapons system it has designed. Specifically, the 
contractor is required by MILSTD 2069 [Ref. l:p. 23] to 
complete an assessment using: 

(1) The results of the mission threat analysis. 

(2) The results of the vulnerability analysis. 

(3) The results of the susceptibility analysis. 

The assessment should address the following categories: 

(1) Laser availability if DOD specifies the need. 

(2) System cost effective analysis. This should be 
done as trade-off studies to determine the point 
where making the plane survivable is no longer cost 
effective. A measure of effectiveness is required 
for comparison purposes. This vill show the 
relative effectiveness of a system with its 
inherent costs. In the conceptual design phase, 
this is limited by the stage of system development. 

(3) Survivability enhancement trade-off studies. The 
contractor is responsible to provide an in depth 
analysis to DOD identifying the effects, benefits 
and penalties in survivability enhancement 


parameters. A trade-off study shall describe the 
survivability enhancement techniques considered; 
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and how vulnerability and susceptibility reduc- 
tion was realized by the use of these techniques. 
Coincident with this should be an assessment on the 
aircraft's performance, weight, cost, reliability, 
etc., if such an enhancement were incorporated. 
The contractor's development of a survivability assess- 
ment is critical to the design of the aircraft. Тһе соп- 
ceptual/preliminary phase, with its degree of freedom, 


makes it an excellent phase to assess a system, from both 


cost effective and performance points of view. 


H. COMBAT DAMAGE REPAIR ASSESSMENT 

The contractor must design a repairable system. For a 
survivability program, the contractor estimates the man- 
hours, costs, logistics and repair levels of the aircraft 
in a combat environment. In the conceptual/preliminary 
design phase, the contractor must highlight design items 
for quick turn-around fixes; i.e., those he feels are 
inherent in the design of the system. He must, if able, 
identify and describe complete repairs and proposed levels 
for major repair systems. Finally, he must identify those 
spare parts which would require a long lead time in pro- 
curement; and the amount of parts stocking required for a 
combat environment. 

MILSTD 2069 [Ref. 1] concludes its documentation of the 
groundwork for survivability program by briefly discussing 
the required survivability enhancement features that are to 


be considered in a design. These are too numerous to 
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discuss individually. The conceptual design phase requires 


that enhancement 
les. The design 
discussed in the 
analysis will be 


design including 


features be the basis for trade-off stud- 
survivability enhancement features will 
case study in the FMECA, then engineering 
used to recommend improvements in the 


incorporation of applicable enhancement 


features listed in MILSTD 2069 [Ref. l:pp. 25-35]. 


The following chapters encompass the case study itself. 


Ihe next chapter 


defines the design of the aircraft used 


in the assessment. 
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IV. THE АШКЕ 


The aircraft used for this case study is the result of 
a course the author took at NPS. An RFP was developed by 
Professor R.D. Zucker to be used as the basis for the de- 
sign. It is a generic, unclassified RFP, having no known 
connection to any existing or proposed weapons system. The 


RFP was presented as follows. 


А. REQUEST FOR PROPOSAL 


-ТҮРЕ: Light/medium weight attack aircraft, 
land or carrier based. 

-СВЕМ: 1 (single seat) 

-MINIMUM PAYLOAD: 4 cruise missiles (1200 lbs. each) 
4 sidewinder missiles (190 lbs. 
each) 


-PROPULSION SYSTEM: generic "rubber engine" capable of 
producing 20,000 lbs. thrust at sea 
level. 


-DESIGN SPEED: Mach 1.1 (dash speed-total mission 
may be subsonic). 


-TAKE-OFF DISTANCE: 3000 EE. (from rand) 
-LANDING DISTANCE: 3500™ft. (to ано) 


-PRIMARY MISSION: Low level ordnance delivery from ei- 
ther carrier or land base, with full 
payload and no external fuel. 

(See V. Mission Threat Analysis) 


-ALTERNATE MISSION: High level ordnance delivery from 
either carrier or land base, with 
full payload and no external fuel. 
(See V. Mission Threat Analysis) 
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-MANEUVERABILITY: Design load factor--8 g's. 
Sustained turn rate at P(s) = 0 is 
4 с'в ак таси о. з апа 0,000 тс. 
Instantaneous turn rate at 8 g's is 
16. degrees per second at the "corner 
speed and 30,000 ft. 

From this RFP and course material, the conceptual 
design of the A-20 ELIMINATOR was created (See Figures 4.1 
and 4.2). Because the purpose of this case study is to 
assess thejvulnerability of €he@aircrate in thegeonceptual 
preliminary design stage, the majority of work involved in 
creating the response to the RFP has been omitted. This 
response, which was supposed to represent a defense 
contractor's submission of a proposed design, required 175 


pages to complete. For this reason, a summary of design 


and performance specifications for the ELIMINATOR follows. 


В. DESIGN SUMMARY 


Total Airplane 


Overall length 18.23 It 
Overall height 15:20 fE 
Wing 
Area (S) 415.4 £t 
Span (b) 38.129 ЕЕ 
Aspect Ratio (AR) 3.5 
Chords 1 
Root Chord 172223 Іс 
Tigo enora MARTE 
MAC Шаг? 
у-МАС uo rt 
L.E. SWeep 41.5 deg 
c/4 Sweep 35.7 deg 
Taper Ratio © 25 
tO uu 5t 
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Figure 4.1  A-20 
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(four view) 


ЖОПЕ ИНТ POP 


Ет апте 4.2 
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Horizontal Tails 


Tail Coefficient 

Area (S per tail) 

L.E. Sweep 

Span (exposed per tail) 
Taper Ratio 


Chords 
Root Chord 
Tip Chord 
MAC 
У-МАС 

Бус 


Vertical Tails 


Tail Coefficient 

Area (S per tail) 

L.E. Sweep 

Span (exposed per tail) 
Taper Ratio 


Chords 
Root Chord 
Tipi chora 
MAC 
y-MAC 

ис 


Engines 


Thrust-to-Weight 
with afterburner 
м/о afterburner 
Number of Engines 
length 
diameter 
weight 
Maximum Thrust at Sea Level 
Capture Area (per engine) 


Aircraft Weight 


М (о) 
W(e) 
W(f) 


Landing Gear 


Main Landing Gear (single tire) 
Diameter 
Width 
Wheel Diameter 
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7.5% 


0.6 

Бр ВМ ЕЕ 
41,45 deg 
8.0 с 
022212 


ОШО ET 
3.25 ГЫ 
6.88 ГЕ 
Geo? Le 
т 


1.04 

0.61 

2 

ЕЕ 
2.4 fe 
1450.0 lbs 
38600 m p: 
1.68 Sg ІС 


вав? 10 
18089 lb 
10899 lb 


28.7 in 
8.6 in 
13.4 in 


Main Landing Gear Shock 
Stroke 
Strut Diameter 
Minimum Shock Length 


Nose Landing Gear(dual tire) 
Diameter 
Width 
Wheel Diameter 
Nose Landing Gear Shock 
Stroke 
Strut Diameter 
Minimum Shock Length 
Balance Parameters 
Static Tail Down Angle 
Turnover Angle 
-AERODYNAMICS SUMMARY 


Design Lift Coefficient (Mach 0.87) 
Maneuvering Devices 


L.E. Flaps 
Т.Е. Flaps 


-РЕКЕОКМАМСЕ 50ММАБҮ 
Take-off distance 
Landing distance 


Maximum Speed 


Sea level with AB/without AB 
30000 ft with AB/without AB 


25 in 
ГІП 
SK 215 


217285 E 
6.8 in 
lor m 


ом 
202121 
5.04 me 


15.0 deg 
53.97 ен 


0.254 


0-34 deg defl 
0-17 deg defl 


ОБЕ Е 
OMS 


1.04M/0.8M 
1.1M/0.9M 


For the purpose of this case study, the author went 


Бш 


beyond the purely conceptual design arena into some 
preliminary design work; creating and-sizing the aircraft's 
subsystems, such as the hydraulics, flight controls, 


propulsion, etc. This was done to ensure a realistic 


component base for the case study. This design work was 
based on existing systems in the inventory and current 
developments and technology in aircraft design. 

It was not the author's intent to design the most 
survivable aircraft possible. The A-20 was designed to be 
representative of current technology. The survivability 
features inherent in the design will only lead to a better 


understanding. of the methodology used in the assessment. 
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У. A=20 MISSION THREAT ANALYSIS 


The Mission Threat Analysis is the first step in an 
aircraft survivability assessment. Background on the 
methodology for the Mission Threat Analysis is found in 
ерсек 3 Geerall [Reft. 2]. Specifically, Section 3.7 
(pages 115-116) presents the steps Ball delineates as 


necessary for a proper assessment. 


A. MISSION ANALYSIS 

The Mission Analysis for an aircraft in the concep- 
tual/preliminary design phase is driven by the RFP. For the 
A-20, the RFP requires the primary mission to be a high- 
low/low-high mission with speeds and altitudes depicted 
generically in Figure 5.1. The ordnance load is dependent 
upon target selection and intelligence. The alternate 
mission is stated in the RFP as a high-high/high-high 
mission profile as depicted generically in Figure 5.2. 
Again the ordnance load is dependent upon target selection 
and intelligence. 

From the design standpoint, the A-20 is a multi-mission 
attack aircraft. It is designed to deliver ordnance on a 
designated target in a variety of roles that fit both the 


primary and alternate mission descriptions such as close 
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Тахі апа take-off 
Clim &e 30,000 ft» cruise altitude 
Cruise at 0.75 Mach for 250 NM to ingress area 
Descend to ingress point (sea level) 
Ingress 50 NM at 0.9 Mach to target area 
Low altitude ordnance delivery on target 
Fly 50 NM to egress point at 0.9 Mach 
Climb Бог 30,000: 28. ст тв Єё ай ий  сєе 
Cruise at 0.8 Mach for 250 NM to descent porns 
. Descend to loiter altitude 
Loiter at 0.27 Mach at sea level for 20 minutes 
Approach, land and taxi to ramp 


Figure 5.1 Generic High-Low/Low-High Mission 
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Taxi and take-off 

Climb -2&2 30.000 ft. cruise altitude 

Cruise at 0.75 Mach for 353 NM to target area 
High altitude ordnance delivery on target 

Cruise at 0.8 Mach for 353 NM to descent point 
Descend to loiter altitude 

Loiter at 0.27 Mach, at sea level for 20 minutes 
Approach, land and taxi to ramp 


о Јат ~ о r2 


Figure 5.2 Generic High-High/High-High Mission 


Э 


air support/tactical interdiction, surface combatant de- 
struction, armed reconnaissance and defense suppression. 

Of the missions mentioned, the close air support/ 
tactical interdiction mission was selected for case study 
evaluation. This mission requires the aircraft to be 
exposed to surface and air threats from either sea or land 
based systems. The RFP requires an assessment from both sea 
and land based operating theaters. The spectrum of threats 
that the A-20 could be exposed to covers the majority of 
the Soviet naval and cities defense inventory. 

Specific missions as conceived by the author can be 
seen in Figures 5.3 and 5.4. The aircraft can be deployed 
from either sea or land based assets and can fly the 
mission profile as depicted to either high or low level 
ordnance delivery, depending upon mission requirements. 
This case study will examine the threats expected in the 
low level scenario. 

The A-20 leaves it base of operations (either carrier 
for USN or land for USAF) and proceeds to fly the high- 
low/low-high mission. Figure 5.3 shows the combat radius 
to be approximately 300 NM. This mission assumes no 
external tanks or in-flight refueling. 

The tactics conceived for an attack mission of this 
type are those which are characteristic of attack aircraft 
currently in the US inventory. Depending on the ordnance 


to be delivered, these tactics could encompass a low 
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altitude evasive ingress and pop-up ordnance delivery (for 
bombs and cruise missiles stored in the weapons bay--see 
Figure 5.5), a straight-in high speed strafing run 
(utilizing the 20 mm cannon), or a jinking-maneuvering air- 
(ата Scenario utilizing the sadewinders (situated on the 


external stations). 


B. THREAT ANALYSIS 

Because of the conceived design versatility of the A- 
20, the threats it could encounter in a hostile environment 
encompass the majority of Soviet SAM/AAA arsenal. Over 
land, the A-20 could encounter anything from a 250-23-4 
"Shilka" to an SA-7 or SA-9 site. At sea the threats are 
just as numerous; the A-20 could anticipate encounter 
conditions with 76 mm AAA or any one of the SAN systems. 

Because this case study is using the close air sup- 
port/tactical interdiction mission for an analysis, the 
threat to be assessed is narrowed down to the following 
representative, generic, system: 


(1) SA-X, a generic IR homing missile. The fragment 
size is 100 grains for analysis. 


This threat was chosen because of its utility against 
low level targets and its strategic importance to the 
Soviet defense plan. This assessment will determine the 
single hit vulnerability values of the A-20 for this threat 


propagator based on engineering evaluations of the 
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conceptual/preliminary design. Specifically, the component 
and aircraft probabilities of kill given a hit, the 
component and aircraft probabilities of survival given a 


hit, and the component and aircraft vulnerable areas. 


E 


ҮТ... А-20 ЕЬБЇСНТ АМР МЇБ5 ОМ .ВБ5Э5БЕМ ЕР -ЕПМСТТОМО 


The methodology for this task is found in both Chapter 
2 and Chapter 5 of Ball [Ref. 2]. Ia @Wapter 2, pages 39- 
60, Ball discusses a tactical aircraft and its systems in 
detail to help the reader learn the major components and 
their importance. In Chapter 5, pages 138-140, Ball 
presents the methodology to conduct the Flight and Mission 
Essential Function portion of the analysis. 

Flight and Mission Essential Functions are those 
functions that must be properly performed in order for the 
aircraft to complete its mission. These functions are also 
known as "critical" functions. They are functions that 
must be performed by each of the aircraft's systems, sub- 
systems and components to meet the survival requirements of 
each applicable kill category; either conventional attri- 
tion or mission abort. The kill category selected for this 
case study is the attrition kill. The attrition kill is a 
measure of the degree of aircraft damage which renders it 
incapable of continued conventional flight. This results 
in a crash with damage beyond that of economic repair, and 
a loss of the aircraft from the inventory. The level of 
attrition kill selected for analysis is the "5 minute A- 


level kill" as described by Ball [Ref. 2:p. 136]. 
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Required mission functions are those necessary to 
conduct the missions determined by the Mission Threat 
Analysis in the previous chapter. These missions can be 
divided into separate and distinct phases in order to 
determine which subsystem contributes to a mission 
essential function, a flight essential function (such as 
ЕЕ or Control), or Бобр There are several 
phases common to all the missions discussed. They are: 
) mission planning 
) man up/take off 
) rendezvous, climb to cruise altitude 
шм Шимвассісаіргог11е 
) rendezvous, climb to cruise altitude 
) 
) 


descend to marshall/begin approach 
carrier arrestment/land 


(1 
(2 
(3 
(4 
(5 
(6 
(7 
From the case study standpoint, the most critical phase 
of the analysis is phase four, the tactical profile phase. 
The aircraft must be able to fly and perform its designed 
tactical mission of delivering ordnance during this phase. 
Since the methodology is the same for all seven phases, 
only that involving phase four will be demonstrated. Phase 
four may be further broken down into subphases to deter- 
mine subsystem contributions. 

(4) Fly Tactical Profile 
= с орбаве==== 
-descend to ingress point 
-descend to tactical low level altitude, commence 
evasive flight profile 
-search and acquire target 
-perform tactical weapons delivery maneuver 


-Weapons release 
-resume evasive flight profile to egress point 
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For case study purposes, the aircraft is composed of a 
number of systems that can be broken down into various 
subsystems that affect its ability to fly in a controlled 
flight environment and to conduct and complete its mission 
(Ref. 2:pp. 39-60]. Table 6.1 shows the aircraft broken 
down into various systems and subsystems with the functions 
of each listed. 

Using the subphases determined from the mission profile 
phase and the systems and subsystems (and their functions) 
as noted in Table 6.1, a table or matrix is developed to 
show which systems are required during each subphase of the 
tactical profile. Table 6.2 is a summary of the final 
analysis of the Mission and Flight Essential Functions for 
the tactical profile phase of the overall mission. For 
this table, each function of the system and subsystem was 
evaluated to determine its participation in the success of 
the overall phase. As can be seen, some systems and sub- 
systems contribute to both the flight and mission success 
of the phase; while others, such as the avionics, contrib- 
ute to only the mission portion of the tactical profile 
phase. 

This method of analysis is done for each one of the 
mission phases. This analysis of which systems and 
subsystems provide the essential functions is the first 
step in determining each system's and subsystem's critical 


components. Now that this chapter has presented the 
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TABLE 6.1 SYSTEMS/SUBSYSTEMS AND FUNCTIONS 








System/Subsystem Puneet ron 
Pilot Maintain aircraft control 
Engines 
Compressors 
Combustors 
Turbines Provide and/or maintain 
Fuel Controls required thrust 
Hydraulics 


Oil Systems 
Electrical Systems 
Mounts 


Accessory Drives 


Throttle Control Subsystem 


Mechanical Flight Controls 
Longitudinal Linkages 
Lateral Linkages 
control Stick 


Eussmndtic Flight Controls 
Flight Control Computers 
Flight Control Surfaces 
Rate Sensors 
Air Data Sensors 
Stick Force Sensors 
Accelerometers 
Rudder Pedal Transducers 
Бесе Electrical Link 


Electrical System 


Fuel System 
Tanks 
Lines 
Pumps 


Provide power for acces- 
sories 


Provide control of engine 
power output. 


Provide complete mechanical 
back-up control in case of 
Automatic Flight Controls 
failure. Provide pilot in- 
put to control sub£acese 


Provide electrical signals 
сажа ласа сее даеце обе 
faces. 


Provide electrical power 
during all flight phases. 


Store and deliver fuel to 
engines. 
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System/Subsystem 


Hydraulic Subsystems 
Reservoirs 
Accumulators 
Lines 
Pumps 
Manifolds 
Filters and Coolers 
Primary Actuators 


Structures 
Control Surface and 
Wing Attach Fittings 
Spar Caps 
Control Surface and 
Wing Attach Points 


Air Conditioning Subsystem 


Airborne Weapons Control 
Components 


Communication and 
Identification Components 


Electronic Warfare 
Components 


TACAN 


Mission Computers 
Instrument Panels 
Displays 


Radar 


Air Data Equipment 


SYSTEMS/SUBSYSTEMS AND FUNCTIONS 


Function 


Provide hydraulic power from 
at least one system to move 
primary control surfaces, 
weapons bay door actuators, 
cannon, landing gear, etc.. 


Carry structural loads and 
provide for structural 
integrity о2  е ан ё єє 0. 


Provide required air condi- 
tioning for selected com- 
ponents. 


Provide airborne weapons 
control- -and monitoring: 


Provide communication and 
identification. 


Provide ECM capabilities. 


Provide navigation capability 


Provide data processing 
capability. 


Provide pilot monitoring and 
control of subsystems. 


Display information 
Acquire, process and 


display air speed and angle- 
of-attack information. 
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flight and mission essential functions methodology of the 
эг Nene cla scer Will provide the Fa?Ture Mode, Ef- 


fects and Criticality Analysis (FMECA) for the aircraft. 
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VII. A-20 FAILURE МОВЕ, БРРЕСТО, АМО СЕРШРСАВ ШАР АЦА ТЕРИ 


The methodology for the Failure Mode, Effects, and 
Criticality Analysis (FMECA) is presented by Ball [Ref. 2] 
in Chapter Five. The FMECA is broken down into two parts, 
a Failure Modes and Effects Analysis (FMEA) and a Damage 
Modes and Effects Analysis (DMEA). Also included in this 
section (but not actually part of the FMECA as required by 
MILSTD 2069), is a Fault Tree Analysis (FTA). The FTA 
is an alternate, and very effective, approach to identi- 
fying the critical components of a system. Each of these 
tasks will be applied to the aircraft using the method- 


ology found on pages 138-153 of Ball (Ref. 2]. 


А.  A-20 FAILURE MODE AND EFFECTS ANALYSIS (FMEA) 

When a survivability analysis is conducted on a design, 
the FMEA is normally provided by engineers who are concern- 
ed with system safety, reliability and maintainability. It 
is based on design requirements, historical data (if the 
system is still in concept stage), predicted performance 
measurements and sound engineering judgement. This analysis 
is not concerned with the cause, but with the effect. The 
FMEA for this case study is presented in two parts: (1) the 
systems descriptions and (2) the results of the analysis in 


tabular format. 
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The major input to the FMEA is the physical and func- 
tional description of the aircraft and its subsystems and 
the data obtained from the Flight and Mission Essential 
Functions Analysis. For an aircraft in the conceptual/pre- 
liminary design phase, this consists of боп па1 drawings 
and narrative descriptions of what the designer thinks the 
aircraft should look like and be capable of. 

The FMEA is usually a single component failure analy- 
Sis. It is a procedure that does not look at the cause of 
failure, but at the component failure itself and its effect 
upon the system; i.e., can it (the subsystem and system) 
Still perform its essential functions with this component 
damaged. In other words, how does the failure of the com- 
ponent affect the subsystems operating ability; which in 
turn affects the systems operating ability. 

The FMEA for this case study is presented below in two 
parts: (1) the systems descriptions and (2) the results of 
the analysis in tabular format. 

1. Systems Descriptions 

Conceptual drawings (see Figures 7.1 through 7.6) 
and a brief description of the Fuel, Hydraulics, Flight 
Controls, Propulsion, Armament and Structural Systems of 
the case study aircraft follows. These subsystems were 
chosen for analysis because they are the major subsystems 
of the aircraft and are well developed in the conceptual/ 


preliminary design phase. Also, each of these subsystems 
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has an affect on the ability of the aircraft to perform its 
essential functions in the tactical subphase (as determined 
in the Flight and Mission Essential Functions analysis). 
a. The Fuel System 

The A-20 fuel system consists of fuel storage 
and transfer tanks, plumbing, on board and in-flight fuel- 
ing and refueling devices, and associated filters and 
pressurization system. As seen in Figure 7.1, there are 
six internal tanks: four fuselage tanks, and two integral 
wing tanks. In addition, there is a vent tank located in 
each vertical stabilizer. The A-20 aso Has the capability 
to carry a centerline mounted external fuselage tank. 

The internal fuel system is designed to carry 
10,400 pounds of fuel. The two fuselage tanks located 
longitudinally along either side of the weapons bay serve 
as transfer tanks. The integral wing tanks also serve as 
transfer tanks. The aft fuselage tank, located in the 
underside of the aircraft, is also a transfer tank, but can 
be switched to a feed tank for either engine if necessary. 
The forward fuselage tank is the primary feed to both of 
the engines with each engine having a separate feed line 
from this tank. This tank is non-transferable and carries 
the "get-home" fuel. The forward and aft tanks are both 
self sealing. All tanks have fire/explosion suppresion 
foam installed in the ullage. The vent tanks in the verti- 


cal tails are designed to collect fuel that happens to get 
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Figure 7.1 А-20 Еце1 System 


TS 


into the venting lines during high "g" maneuvers. It is 
collected in these tanks and gravity fed back into the fuel 
system. 

As with most Navy fuel systems, fuel transfer 
is accomplished by motive flow, thus eliminating the need 
for electrical power to feed the engines. The transfer 
system can automatically sequence fuel to keep the feed 
tanks full for maximum engine performance; or the pilot can 
select fuel transfer manually under eure сона лето. 

The automatic transfer is designed to take into account 
weapons release and burned fuel to maintain a relatively 
constant center of gravity location through all flight 
regimes. 

As can be seen from Figure 7.1, the majority of 
the plumbing for the fuel system is within the tanks, help- 
ing to eliminate excess exposed surface area. The motive 
flow and boost pumps are driven off the accessories sec- 
tion. Boost and motive flow pumps are both three stage, 
Single shaft pumps. These pumps operate by the venturi 
principle with regards to pressure and flow rates. 

b. The Hydraulic System 

The hydraulic system supplies hydraulic power 
to all flight control surfaces, the landing gear brakes, 
the cannon drive, the weapons bay doors, the landing gear 


mechanism, and the nose wheel steering. 
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Figure 7.2  A-20 Hydraulics System 
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The hydraulic system, shown in Figure 7.2, con- 
sists of two independent hydraulic systems with two inde- 
pendent circuits in each system. There are three hydraulic 
reservoirs; one is always in backup for the other two. 

Each System is driven by an engine driven pump with elec- 
trical backup at a pressure of 3000 psi. Each system is 
capable of supplying hydraulic power to all flight con- 
trol surfaces. The systems are monitored constantly by a 
control network for correct pressure and flow. The system 
can direct flow through one circuit while cutting off the 
flow in another. The control network can shut off one 
hydraulic system with automatic switching that is dependent 
on system pressure and flow rate. If the pressure in one 
system drops below 1200 psi., flow to this system is cut 
off and the backup reservoir comes on line to that system. 
C. The Flight Control System 

The flight control system of the A-20 is shown 
in Figure 7.3. It is actually three independent control 
Systems, two electrical and one mechanical. There is an on 
board Automatic Flight Control System (AFCS), with a separ- 
ate circuit for each one of the two flight control compu- 
ters. The flight control computers are located in the 
forward electronics bay, just aft of the radome, and in the 
aft electronics bay, behind the cockpit. All control sur- 


faces can be controlled by any one of the three systems. 
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In normal operation, all control responses are 
due to electrical transmissions received from control stick 
and rudder inputs. At the same time stick and rudder pedal 
inputs are mechanically backed up through standard pulleys 
and linkages. All control surface movements come from hy- 
draulic boost response to electrical or mechanical inputs. 
In the event of a hydraulic problem, the mechanical system 
can control the airplane without the boost system. 

The aircraft is controlled in all three axis by 
the two flight control computers equipped with their own 
accelerometers, rate sensors, stick force and rudder pedal 
transducer inputs. Each computer has two channels, and 
each has the capacity to process all inputs and perform all 
necessary computations to fly the aircraft. In effect, 
there is multiple redundancy in the flight control system 
with both electrical and mechanical backups. 

а. The Propulsion System 

The propulsion system proposed for the A-20 is 
of 1990's technology. It is powered by a derivative of 
current development engines. The thrust capability of 
these engines is 20,000 pounds thrust per engine in maximum 
afterburner at sea level. 

As shown in Figure 7.4, the propulsion system 
has a unique intake arrangement. Designed with surviv- 


ability in mind, the intake wraps around the top of the 
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Figure 7.4 A-20 Propulsion System 
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fuselage, with the wings adding protection against projec- 
tile penetration. 

The design engine in the A-20 is a low by-pass 
turbo fan engine. A three stage fan and an eight stage 
compressor are each driven by a single stage turbine. `The 
compressor is of variable geometry with continuous by-pass 
from the fan to the augmentation section. There is no 
acceleration bleed system required for the engine. 

For combustion, the engine is equipped with a 
flow through annular type combustor utilizing eight combus- 
tion cans each of which has four atomizing fuel nozzles. 
The burning gases are directed rearward through a single 
stage turbine which drives the fan and the high pressure 
оле ора 

Augmentation is continuous and in all ranges of 
operation. The afterburner operates with injected fuel 
through six manifolds located in the exhaust core and fan 
discharge stream. Ignition is caused by a fuel rich 
mixture torching through the turbine stage to the manifold 
and flame holder. Fan discharge air cools the after burner 
liner in the duct and and helps maintain a low exterior 
skin temperature on the engine covers. The variable area 
nozZle is hydraulically actuated with its own hydraulic 
system. 

Each engine is independently controlled with 


single throttle actuation by the pilot. The engine control 
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then programs the variable nozzle area, temperature levels, 
turbine speeds and correct fuel flow for proper and effi- 
cient operation. 

Ihe lubrication system is self contained for 
each engine. The capacity of the system is 4.5 gallons, of 
which 4.0 is useable. The bearing system is composed of 
three bearings for the fan rotor and two bearings for the 
high pressure rotor. The low pressure rotor bearings 
support the fan forward on the front frame, aft on the mid 
Lrame, and the aft end of the fan turbine in the turbine 
frame. 

The high pressure rotor is supported by a 
thrust bearing at the forward end in the mid frame and by a 
de erential bearing at the aft end ofmthe turbine with the 
Ша тоот. 

Electrical power for engine start and electri- 
cal control is supplied by the alternator. Ignition is 
automatic depending on the system requirements. 

The accessory gearbox drives one level of 
hydraulic power, the electrical generators and other 
miscellaneous uses. Bleed air from high and low stage 
compressors is utilized for auxiliary equipment operation 
such as engine anti-ice and the environmental control 


system. 
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е. The Armament System 

The Armament System is shown in Figure 7.5. 
The design of the A-20 incorporates a weapons bay. 
Tradeoff studies revealed that the aircraft, with its 
unique intake system, needed the majority of the stores to 
be internal to sustain efficient high арс operations. 

The A-20 is a heavily armed aircraft. There 
are four sidewinder missile mounts on the exterior; one on 
each wing tip and one each at the fuselage and wing 
underside junction. 

The weapons bay has the capacity to carry 
either four cruise missiles or a combination of bombs/mis- 
siles with a total interior weapons load weight of 6,500 
pounds. The weapons bay doors are both hydraulically and 
electrically actuated, and fold into themselves for drag 
reduction. 

Mounted on the left hand interior of the fuse- 
lage, adjacent to the cockpit, is a 20 mm cannon with a 
capacity of 2,000 rounds per minute. 

All weapons selection controls are on the 
pilot's control stick and throttle controls, giving hamem@the 
capability to select, arm, and fire the weapon without ever 


taking his hands off the primary controls. 
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Figure 7.5 A-20 Armament System 
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f. The Structural SF cem 

The A-20 structure groups (Figure 7.6) are the 
nose radome, the weapons bay, the crew station, the forward 
fuselage, the center fuselage, the aft fuselage, the in- 
board wing section, the outboard wing section, the vertical 
stabilizers and the horizontal stabilators. 

The nose radome provides an electronically 
transparent window for radar transmissions. It is a struc- 
tural member, housing the forward avionics bay and semi- 
monocoque in construction 

The crew station is directly aft of the radome 
section. It has a canopy enclosed cockpit and provides ап 
oxygen environment for the pilot. All pilot controls and 
features are in the cockpit. There is an ejection seat, 
center mounted control stick and side mounted throttles. 
The pilot can control all flight mission essential systems 
from these control mounts. 

The weapons bay is located beneath and aft of 
the cockpit; @enc@thira овшеле алеваневша и теле Тепеепесі 
the fuselage. It consists of a cavity large enough to 
carry four cruise missiles twelve feet in length. It is 
convertible to other types of ordnance. The weapons bay in 
itself is a structural member, built as one unit to be 


installed in the fuselage. 
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Figure 7.6 
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The forward fuselage is conventionally соп- 
structed with multi-stiffened longerons and is semi- 
monocoque. It is strengthened for a 20 mm cannon located 
adjacent to the pilot on the port side. It provides a 
structural bulkhead for the forward avionics bay and com- 
pletely supports the aft bay. It also provides attachment 
bulkheads for the forward portion of the weapons bay and 
the forward fuselage fuel tank. Structurally, the gorwamq 
fuselage has major longerons, shear webs, bulkheads and 
floors. It is compartmented for strength and ease of 
maintenance. 

The center fuselage carries the wrap around 
intake system, the forward fuselage transfer tank, the wing 
carry through box, roota Запа Сие ассасииелеЕ points. It 
also has the main landing gear supports, assorted struc- 
tural members, and the aft mounting bulkhead for the 
weapons bay. The backup hydraulic reservoir and pump are 
located on the starboard side and there is also fuselage 
mounted sidewinder stations beneath the wing. 

The aft fuselage consists of the engine bay 
cavities, a longitudinal alloyed bulkhead between the en- 
gines, horizontal stabilator attachments, vertical stabil- 
izer attachments, tail hook and speed brake assembly. Also 
the primary hydraulic reservoirs are located adjacent to 


the engine accessory drives. 
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The inboard wing consists of the wing box, wing 
Beer, amd integral fuel tank. There is a three cell torque 
box and the flap structure. The leading edge is extendable 
with the necessary hydraulic and electrical equipment 
located within. The wing spars and ribs are all machined 
and cast aluminum. The skin is both aluminum and graphite 
epoxy composites. 

The outboard wing section consists of a 
mutispar, Multibox structure which extends from the ‘fold 
joint to the wing tip. There is no fuel in this section, 
but it does have an outboard sidewinder installation pod 
located on the tip. There is also the remaining leading 
edge extension plumbing and an aileron which extends along 
the entire outboard section. The materials used in this 
section are primarily graphite epoxy for the skin and cast 
aluminum for the spars. 

The vertical stabilizers are mounted with an 
eighty one degree dihedral on the aft fuselage assembly. 
They carry the vent tanks and navigation lights and consist 
of three spars and four box beams. The skin covering is 
aluminum and fiberglass. The moving control surfaces are 
made from graphite epoxy composites. 

The horizontal stabilators are constructed 
entirely of graphite epoxy composites and fiberglass. They 
have a honey combed interior and rotate upon a titanium al- 


Шог nub. 
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As can be seen from the preceeding figures and 
discussion, te A-20 was designed for ease of major main- 
tenance and combat damage repair. 

2. Analysis Results 

Consistent with the format previously established, 
the fuel system will be the only system broken down into 
detail and analyzed using the FMEA methodology to produce 
the final product, Table 7.1, the FMEA Matrix. 

The fuel system components have been analyzed to 
determine how they could fail and what effect this failure 
has on the system. Results of the FMEA analysis performed 
on the fuel system are shown in Table 7.1. The most 
important result of this analysis is the input it provides 
to the preparation of the list of critical components, 


which is the output of the assessment. 


В. A-20 DAMAGE MODE EFFECTS AND ANALYSIS (DMEA) 

The DMEA is dependent upon the kill criteria and the 
threat. It relates potential failures such as those de- 
termined in the FMEA, with the threat weapons and their 
damage mechanisms. It also associates the effects of the 
failures to the kill criterion, redundancy and flight con- 
ditions and provides the checklist for the fimal determin- 
ation of critical components and their redundancy 


relationships. 
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Normally а DMEA is comprised of four sets of ouput 
data: (1) Тһе DMEA Tables, (2) Тле отари те! : ME 
(3) The Kill (or Fault) Trees or Kill Diagrams and (4) The 
P(k/h) Functions. In this case study all four of these 
data will be presented. A Fault Tree Analysis is also 
included in this section. As mentioned earlier, this is 
not required by MILSTD 2069 |Беї. 1). It is being 
presented here because it is an alternate and extremely 
effective method of component identification. 

Since the FTA is being used in this analysis, the 
presentation of DMEA results will be in a different order 
than defined by MILSTD 2069 [Ref. 1]. 

The results will be presented as follows: The DMEA 
Tables and The Disablement Diagrams are developed for the 
fuel system only; following the routine established in 
earlier sections. The FTA is presented next not only for 
the fuel system, but for the entire aircraft. This is done 
to show how effective the FTA is and to show that the depth 
of analysis makes it an excellent alternative to the FMEA. 
The list of critical components is presented in conjunction 
with the FTA. This was done to show how this list is the 
logical result and product of the FMEA, DMEA Tables, 
Disablement Diagrams and FTA. The Kill Tree is presented 
next. This is also created for the entire aircraft, giving 
a visual presentation of the critical components and 


redundancy relationships The final data presented are 
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P(k/h) Functions. They are presented іп conjunction with a 
representative list of critical components from the entire 
aircraft. - This part of the assessment is presented last to 
allow for input to the list from every possible source of 
analysis. 

Recording to MIUSTD 2069 [REf. l:p. 15], the list of 
critical components is complete after creating the DMEA 
Matrix. By performing the analysis of the A-20 in the 
order discussed, the author feels a more complete and 
thorough list of critical components is the end result. 

1. The DMEA Matrix 

The DMEA Matrix for the Fuel System is shown in 
Table 7.2. This matrix relates the components and their 
failure modes to the probability of kill given a hit 
functions (P(k/h)), kill criterion, and the redundancy 
categories in a tabular format. 

As seen from Table 7.2, not all of the components 
of the fuel system are considered critical for the level of 
kill being analyzed (A-level attrition). This is one goal 
of the DMEA, to determine those components which are 
болса to the kill level of the aircraft... Table 7.2 
shows the fuel system broken down into sufficient detail to 
allow an evaluation of its components and the role they 
play in the provision of essential functions. - 

Table 7.3 explains the notes found in the remarks 


section of the DMEA Matrix. This is a clarification of the 
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TABLE 7.3 FUEL SYSTEM DMEA NOTES 





Component not critical for vulnerable area 
calculations. 


Location adjacent to weapons bay makes this tank 
very important in vulnerable area calculations. 


Ullage is considered only when tank is less than 
SoOSMEUTI. 


Tank has "get home" fuel, can feed both engines 
if necessary. 


Tank is kept full by auto-sequencing of fuel 
system. 


Bladders and Tanks themselves are not considered 
critical for yusenerable"areawealculatiomp" 


Lines from feed tank to engines are redundant. 
Allows feeding of both engines. 


Most of fuel lines are internal and short as seen 
in Figure [7.1]. Rupture of line will not 
affect flow in majority of system. 


Each wing tank has two paths to flow to engine. 
Can direct feed is necessary. 


Either vent tank capable of venting system. Vent 
hazard is small. Area is not considered in 
vulnerable area calculation. 


Loss of both pumps results in fuel starvation 
because of inability to transfer. 


TOT 


effect the damaged component has on the system. Notice 
that several of the remarks refer to the FMEA, an example 
of the interrelationship between the types of assessment. 
2. The Disablement Diagram 
The second set of data developed in the DMEA is the 
Disablement Diagram. The Disablement Diagram combines both 
data from the FMEA and DMEA to display: 


1. The physical location of components within the 
system. 


2. The failure mode of a component. 


3. The effect of the failure on the subsystem and the 
aircraft: 


4. The resultant aircraft kill criteria. 

Figure 7.7 show the Fuel System Disablement Dia- 
grams. The components and subsytems that can if killed 
would lead to an attrition kill are exhibited graphically 
in flow chart fashion. Note the redundancy in the motive 
flow pumps and engine driven fuel systems. 

3. The Fault Tree Analysis (FTA) 

The Fault Tree Analysis, (the output of which is 
known as the Fault Tree Diagram or Failure Analysis Logic 
Tree (FALT)), is not specifically required by MILSTD 2069 
[Ref. 1] as a means of determining the critical components 
of the system. However, it is often used as a substitute 
for the FMEA when one is not available. Because of its use 
as one of the principal tools of system safety, reliability 


and maintainability analyses, it may be preferred over the 
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Figure 7.7 A-20 Fuel System Disablement Diagram 
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Figure 7.7 (cont.) A-20 Fuel System Disablement Diagram 
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Figure 7.7 (cont.) A-20 Fuel System Disablement Diagram 


LOG 


FMEA. This analysis is valuable in that its logic and 
methodology involves development of a system hierarchy in 
pornssofoasspecific characteristic, result or effect. As 
such it can take into account both hardware failures and 
human effects. 

The FTA begins with an undesired event, in this 
case study an A-level attrition kill. ТЕ then logically 
determines what event or combination of events (i.e., 
component or subsystem failures due to penetrator damage) 
can cause the undesired event to occur. 

For most aircraft FTA's, attrition is caused by the 
inability of the aircraft to fly or land. For the A-level 
II Í JO), Only the inability of the aircraft to fly is 
analyzed. The assessment then logically branches down into 
a detailed analysis of what can cause the attrition. Ball 
(Ref. 2] discusses the FTA and its logic symbology on pages 
#79—151. 

Figure 7.8 and Table 7.4 show the results of the 
Fault Tree Analysis performed on the A-20. The Fault Tree 
Diagram or FALT is the graphical presentation of the 
analysis. Figure 7.8 shows the aircraft and its subsystems 
broken down, just like in an FMEA, to determine how the 


undesirable event, the A-level attrition, can occur. 
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TABLE 7.4 AlI LERE ENGINE FUEL SYSTEM FAILURE 
COMPONENTS БЕБЕ 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
engine driven fuel pump R penetration 
fuel temperature control R penetration 
fuel control R penetration 
fuel nozzles R penetration 
motive flow fuel line R penetrate/sever 
fuel line-feed tank to engine R penetrate/sever 
swing check valve R penetration-- 
three for 
attrition 


firewall shutoff valve R penetration 
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TABLE 7.4 (cont.) A21 LEFT ENGINE FAN SECTION DAMAGE 
COMPONENT LIST 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
case R penetration 
inlet case supports R penetration 
rotor and stator blades R penetration 
front accessory support R penetration 
A22 LEFT ENGINE COMPRESSOR DAMAGE 
COMPONENT LIST 
COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 

case R penetration 
LP rotor and stator blades R penetration 
HP rotor and stator blades R penetration 
LP compressor hub R sever 
HP compressor hub R sever 


A23 LEFT DRIVE SHAFT AND BEARING DAMAGE 
COMPONENT LIST 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
LP turbine/compressor shaft R penetrate/sever 
HP turbine/compressor shaft R penetrate/sever 
forward end thrust bearing R penetrate/sever 
aft end differential bearing R penetrate 
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шары 7.4 (сопс.) 224 LEET ENGINE COMBUSTOR DAMAGE 
COMPONENT LIST 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
outer case R penetration 
inner case R penetration 
combustion chamber duct R penetration 
bypass duct R penetration 
A25 LEFT ENGINE TURBINE DAMAGE 
COMPONENT LIST 
COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 

case R penetration 
hp bypass air duct R penetration 
hp bearing supports R penetrate/sever 
ШЕ ГОСОГ апа stator blades К sever 
lp rotor and stator blades R sever 
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ШЕЕ 7.4 (Cont.)  АЗІ LEFT ENGINE OIL SYSTEM DAMAGE 
СРПЕОЦЕНТ LIST 


СОМРОМЕМТ REDUNDANCY DAMAGE 
REDATTONSHIP 
scavenge pump drive shaft R sever 
main gear box R penetration 
lube oil scavenge pump R penetration/ 
starvation 





A32 LEFT ENGINE SUPPORT SYSTEM DAMAGE 
СОМРОНЕ тш БШ 


СОМРОМЕМТ REDUNDANCY DAMAGE 
RELATIONSHIP 
fener inlet duct R penetration-- 


fuel ingestion 


engine mount(s) R sever 2 or more 
forward ftor attrition 
mid 

rear 

puseottie actuator R sever/penetrate 
Бове control box R penetration 
bleed control R penetration 


21 


*әләц рэзеэа 

-әл әд jou [TIA pue 

42ӘТ 01 терзтзиэрт 51 
srsÁ[eue эрт5 дЧцБтя 





:930N 


ЧОНФМООЭ. ЧЯЛАБОННФ 
ФНОГА ЗО 5501 


аму 


'IONLNOO MW'LBLLONHHL 


12755401 





obed qaxəu TO ээс 


ТОЧМОӘ JILLOYHL 
"РГ ЗО 5501 


A-20 Fault. Tree Diagram 


Figure 7.2 (cene~ 


113 


ШЕЕ. < (Cont.) Cl LOSS OF LEFT ENGINE THROTTLE CONTROL 
COMPONEN TRIS 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP ` 
[те Те control R jam/sever 
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TABLE 7.4 (cont.) 


СОЛЛЕОМЕМТ 


wing tank 


COMPONENT LIST 


El LEFT FUEL SYSTEM INOPERABLE 


REDUNDANCY 
RELATIONSHIP 


longitudinal transfer tank 


DES 
28550 


forward feed tank 
aft transfer tank 
vent tank 

fuel transfer lines 
motive flow lines 


fuel 
fuel 
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ОАМАСЕ 


fire/explosion 
hydraulic ram 
fire/explosion 
fire/explosion 
hydraulic ram 
hydraulic ram 
structural damage 
puncture/sever 
puncture/sever 
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PIgure 778 (Comes) 
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left 
left 
left 
left 
left 
left 


left 
left 
left 
left 
left 


TABLE 7.490 89m) 


Jl LOSS OPFSIEEREPDSNWING 


CONPONENT LISE 


COMPONENT 


front spar cap 
aft spar cap 
#1 spar сар 

#2 spar cap 

#3 зрак сар 

14 зрак сар 


front Outboard spal weap 
11 outboard spar cap 
#2 outboard spar cap 
#3 Outboard Spar cap 
rear outboard spar cap 


REDUNDANCY DAMAGE 
RELATIONSHIP 
R sever, hydraulic 
R ram--must lose 
R three of six for 
R ашсиТО ТОГ 
К 
К 


sever, hydraulic 
ram--must lose 
three of five for 
attritron 


23 23:23:23 J 
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ШӘЗЕЕ 7:4 (cone?) 122 LOSS OF LONGITUDINAL INTEGRITY 
COMPONENT LIST 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 

forward upper (2) R sever--must sever 
forward lower (2) R three of six for 
forward aft (2) R attrition 
concer Upper (2) R sever--must sever 
center lower (2) R three of six for 
center keel 02) ТЕ Raccrition 
aft upper (2) R sever--must sever 
aft side (2) R three of six for 
aft keel (2) R НЕЕ ЕТОЙ 
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TABLE 7.4 сее 


COMPONENT 


head 
thorax 
abdomen 
pelvis 
left arm 
left leg 
right arm 
right leg 


K2 WEAPONS BAY DETONATION 


) Kl PILOT INGEPACITATED 
COMPONENT LIST 


REDUNDANCY 


RELATIONSHIP 


СОМРОМЕМ Lisa 


СОМВОТ ЕМ 


cannon ammo drum 


missile warheads (4) 
missile rocket motors (4) 


REDUNDANCY 


RELATIONSHIP 


NR 


R 
R 
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DAMAGE 


penetration 
penetration 
penetration 
penetration 
penetration 
penetration 
penetration 
penetration 


DAMAGE 


penetration 


penetration 
of any one 
Of the eight 
can cause 
аранда 


TABLE 7.4 (cont.) KÆ ANOPY FRAME DAMAGE 
COMPONENT LIST 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSEIP 
forward canopy support NR sever 
mid canopy support NR sever 
HmEEcanobpy suppert NR sever 


if more than 
one support 
severed, pilot 
assumed inca- 
pacitated 


canopy hinge NR sever 


Ke ESCAPE GYStEMs DETONATION 
COMPONENT EISI 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
pilot oxygen bottle NR penetration 
Puen rocket catapult NR penetration 
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TABLE 7.4 (соп 7 Э Г102:50Ё НҮҮР ЕЕ  ЕГЄ ОПЕК IE 
COMPONENT EIST 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 

hydraulic accumulator R penetration 

engine driven pump R penetration 

СДІСПІН ЈА R penetration 

elrcust IB R penetration 
penetration 
must оссо in 
botħ circuits 
to lose system 

switching and flow sensor R penetration 


113 [055 ОР ВАСКЈР КЕМЕУКУОТЕ 
COMPONENT PTS T 


COMPONENT REDUNDANCY DAMAGE 


RELATIONSHIP 
backup reservoir NR penetration 
switching and 
sensing monitor NR penetration 
pressure lines NR penetration 
return lines NR penetration 
flow transducer NR penetration 
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ШЕЛЕР А (cont.) 514 LOSS OF HYDRAULIC ACTUATOR SYSTEMS 
COMPONENT LIST 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 

left aileron actuator R penetration 
left aileron sensing 

valve R penetration 
left stabilator actuator R penetration 
left stabilator sensing 

valve R penetration 
ext. rudder actuator R penetration 
left rudder sensing 

valve R penetration 


T33 


SMOITOJ 22771 'obed зхэи uo [7241 ээ$ 


(SOAW) W'*ULSAS 


ЧОНМОЭ LHOI'IJ dfíl 
-ХЭМЧ ЧМПМҮнН 40 5501 





аму 


SWHLSAS ПОМЉМОО Зай, 


заь М “БН Часо 5807 





Ст 


(5044) ича5А5 


ЧОЧІМОО 4НЭТЧА 
ЭТЬЧИОШОЧ AO SSOT 





A-20 Fault Tree Diagram 


Figure 7.8 (Cont) 


134 


"голец родездол зд JOU [[TM 
pue T “ом о Теэтачэрт 
St шэд545 Z “ОМ 


чамоа 


'IVOINLOWISN ЯО 5501 





5087“ 4O 5201 


SMOTTOI етет 'обеа 


3xəƏu uo TIZ'I 


:Ə3ON 


С "ОМ 
WHLSAS ebüdWOoo 
DIET J0 507 


CNW 


aoc 








T ОМ 
WLLSAS AALNAWOD 
ФИНО ЛА 075501 





А-20 Fault Tree Diagram 


Reque 78-(cont.) 


135 


TABLE 7.4 (бОпС.) 1211 LOSS OF FLCIGHI СОПРОВЕЕ ВО» 
COMPONENT DIST 


COMPONENT REDUNDANCY DAMAGE 
RELALIONSH LP 
gyro stabilization system R penetration 
channel 1A R sever 
channel 1B R sever 


both channels 
must be sever- 
ed for loss 


accelerometer R penetration 
rate/motion sensor R penetration 
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TABLE 7.4 (cont.) 1212 ОБЬ ОЕ ВАМ АТВ ВЕНЫ ЕЕ ЫН 
COMPONENT: LIST 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
generator NR penetration 
actuator door NR jam/penetration 


12132 LOSS OF GENERATGDPEIGOM 
COMPONENT ВБ 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
generator R penetration 
drive shaft R sever 
accessories connection R penetration 


52134 Bess OF BATTERY 
COMPONENT LIST 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
battery NR penetration 
essential connections NR penetration 
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и. = (ООП) 22135 LOSS TOF ESSENTIAL DC BUS МО. 1 


COMPONENT LIST 


COMPONENT REDUNDANCY 
RELATIONSHIP 
essential dc bus R 


62137 EOSS OR ESSENTIAL AC BUS 
COMBONENTZCIST 


COMPONENT REDUNDANCY 
RELATIONSHIP 
essential ac bus NR 
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МОРЕ а (сопе.) 1221 1055 ОР LONGITUDINAL STABILITY 
COMPONENT LIST 


COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
push-pull rods R sever 
rod ends R sever 
bell cranks and pulleys R sever 
bearing brackets R sever 
Meee LOSS Or LATP ЕТЕ ТАВТЕТТУ 
COMPONENT LIST 
COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
interconnect bungee NR jam/sever 
push-pull rods R jam/sever 
rod ends R jam/sever 
bellcranks and levers R jam/sever 
L223: LOSG OFT DIRECITONALCTSTAPTLITY 
COMPONENT LIST 
COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
push-pull rods R jam/sever 
rod ends R jam/sever 
bellcranks and levers R jam/sever 


141 


TABLE 7.7 (Cont.) 13205852 2 те Cole: 


СОМРОМЕМТ 


push-pull rods 

rod ends 

bellcranks and levers 
sensor transducer 
сопсвей stack 

stick tarip 


COMPONENT TEIST 


REDUNDANCY DAMAGE 
RELATIONSHIP 
R jam/ sever 
R jam/ sever 
R jam/ sever 
NR penetration 
NR jam/sever 
NR jam/sever 
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TABLE 7.4 (cont.) M1 EXTERNAL MOUNTED ORDNANCE DETONATION 
COMPONENT P PDT m 


COMPONENT REDUNDANCY DAMAGE 
RELATIONS TEP 
Sidewinder warhead (4) R penetration 
Sidewinder rocket motor (4) R penetration 


penetration of 
any one of the 
eight can cause 


attt lon 
M2 STABILATOR LOSS 
COMPONENT Dist 
COMPONENT REDUNDANCY DAMAGE 
RELATIONSHIP 
stabilator mounting hinge NR sever 
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4. The Critical Components 

Table 7.4 ieee the A-20's Critical Components by 
name, redundancy relationship (R--redundant  NR--nonredun- 
dant), and damage or kill mode. These kill modes are 
representative of the ones that Ball [Ref. 2] breaks down 
by major systems and lists in Table 5.1 on page 145 and 
then discusses briefly on pages 143-149. The kill modes 
listed are the most important and most frequently occurring 
modes of attrition. 

Е тре Kill Tree 

The final set of data obtained from the DMEA is the 
Kill Tree (also called Fault Tree by MILSTD 2069 [Ref. l:p. 
ШЕШІ Тһе Кіт сее, пеша Figure 7.9, introduces the 
critical components of the A-20 and illustrates their 
logical redundancy relationships. The Kill Tree is invalu- 
able in that it graphically depicts which components (or 
subsystems) must be damaged or lost produce the particular 
kill level. 

Nonredundant components are those shown in series. 
These components, if individually killed, are sufficient to 
result in the kill. Redundant components are shown in 
parallel with those which they share an operational 
redundancy. The word redundant means that the component 
plus x (x > 1) or more components must be killed to achieve 


F desired kill level. 
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| PILOT *AND ENGINES 


ТЕТ 





LEFT ENGINE 
(A21-25) 


ENGIN 







(two out of two) 


LEFT INDEET 
DUCT 





INLET 







(two out of two) 






LEFT ENGINE 
OTILUSTSTEM 
ГАЗІ 






RIGHT ENGINE 
OPIELOSISTEM 












(two out of two) 






LCESTRENGINE 
THROTTLE 
ACTUATOR 


RIGHT ENGINE 





(two out of two) 






LEFT ENGINE 


EUEL SYSTEM 
(АЈ) 






RIGHT ENGINE 
FUEL SYSTEM 








(two out of two) 







Г.БЕТ 
MOUNT 
FORWARD 


ENGINE LEFT ENGINE 
MOUNT 


MIDDLE 












(two OUt or EEWO) 


LEFT ENGINE 
MOUNT 









RIGHT ENGINE 


(сма out, of two) 


RIGHT ENGINE 
MOUNT 
AFT 





Figure 7.9 А-20 Kill Tree Diagram 
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Figure 7.9 (cont.) А-20 Kill Tree Diagram 
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LONGERONS STRUCTURAL Sistem 
FORWARD FORWARD FORWARD [ FORWARD | FORWARD FORWARD 
UPPER ВЕЕТ UPPER RIGHT LOWER LEFT | LOWER RIGHT KEEL LEFT KEEL RIGHT 





(three out of six) 








CENTER 
KEEL 
LEFT 


CENTERS 
UPPER 
RIGHT 


CENTER 
LOWER 
ШЕРІ 








(threee out of six) 


AFT AFT AFT AFT AFT 
ПЕРЕН ОРРЕВ SIDE SIDE KEEL 
LEFT RIGHT БЕРТ RIGHT RIGHT 


(three out of six) 


WING SPAR CAPS 


LEFT LEFT БЕРТ ШЕЕТ БЕРТ 
ЕКОМТ АРТ МО. 1 NO. 2 NO. 3 


(three out of six) 

















LEFT 
FRONT 
OUTBOARD 


LEFT 
NO. 1 
OUTBOARD 





(three out of five) 


RIGHT RIGHT RIGHT RIGHT RIGHT RIGHT 
FRONT AFT NO L МО. 2 45: 3 МО, 4 





(three out of six) 
















RIGHT 
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OUTBOARD 


RIGHT 
МО. 1 
OUTBOARD 






RIGHT 
OTTS 


RIGHT 
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OUTBOARD 





OUTBOARD OUTBOARD 





(three out or five) 


Figure 7.9 (сопЕ.) 2-20 Қа ива таса 
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n © 
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STABILITY 
LINKAGES 


NO. = FLIGHT 
CONTROL COM- 
COMPUTER SYS 


Е БРОНЕ 
СОМТКОТ, СОМ- 
COMPUTER SYS 


(two out of two) 


COMPUTER COMPUTER COMPUTER 
CHANNEL 1A CHANNEL 1B CHANNEL 2A 


ütour out of four) 


GENERATOR 
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LONGITUDINA 
STABILIT 
CABLES 


COMPUTER 
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BATTERY STABILITY 
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GENERATOR 
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three out of three 
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HYDRAULIC BOOST SYSTEMS 
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PUMP 
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PUMP 
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1 2 





(three out of three) 
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Figure 7.9 (cont.) A-20 Kill Tree Diagram 
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HYDRAULIC ACTUATOR SYSTEMS 
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Figure 7.9 (cont.) A-20 Kill Tree Diagram 
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днвеп»їес емо нен СОЛК Оле ШК" of the Kill 
Tree is required to achieve the A-level attrition kill of 
the A-20. In portions of the tree where there are 
redundant relationships (such as the fuel system, the 
flight control system, the propulsion system or the 
hywermaulics)>, 1Е is easily Seen how this redundancy enhances 
the survivability of the A-20. The more redundant the 
systems are, the harder it is to obtain the A-level kill. 
The values of vulnerability determined in the vulnerability 
assessment portion of this case study will show this 
quantitatively. 

6. P(k/h) Functions and Critical Components 

The culmination of the FMEA and DMEA is the listing 
of the P(k/h) functions for the critical components. A 
representative list of the critical components presented in 
Table 7.4 is given in Table 7.5 This list of critical 
components is not comprehensive for the whole aircraft. It 
is made up of selected components from each major sub- 
system. This was done to enable the reader to more easily 
grasp the methodology of the assessment, instead of being 
burdened with trying to assimilate a very long and detailed 
list. Both redundant and nonredundant components are 
listed to ensure a thorough vulnerability assessment and 
treatment of component redundancy. 

ile probability of kill given a hit functions 


(P(k/h)) are the first quantitative measures of the 
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IABLE 7.5 CRITICAL COMPO ЕЦ 
BY MAJOR SYSTEMS GROUPING 


MAJOR SYSTEMS 
GROUPING 


Propulsion Systems 
Left and Right 


Left Engine 

Right Engine 

Left Inlet Duct 

Right Inlet Duet 

Left Throttle Actuator 
Right Throttle Actuator 


Engine Mounts 


Left Mount Forward 
Right Mount Forward 
Left Mount Aft 
Right Mounier tt 


Pilots Сопко ары 


Left Throttle 
Right Throttle 
Controimseick 
Stick Sensor Transducer 


Hydraulics Systems 
No. 1, 2 and Backu 


Hydraulic Pump No. 1 

Hydraulic Pump No. 2 

Hydraulic CTCE 

Нуакати c Cmc uit IB 

Hydraulic CIrcurti2A 

Hydraulic Circuit 2B 

No. 1 Accumulator 

Backup Reservoir 

Backup Switching/Sensing Monitor 
Left Aileron Actuator 
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P(k/h) VALUES FOR 100 
GRAIN FRAGMENT @ 4000 FPS 
(uninstalled) 


O O O O O O 
со со (л (л O) W 


O OOO 
NM W W 


O OOO 
Ol > бу ON 


СО ОООО оо со 
C) > ду м) (л (л (л QI > > 


ШАРШЕН БН соп.) ёЁТТТСЄАГЭЄӨМРӨОМЕМТ LIST 
BY MAJOR SYSTEMS GROUPING 


MAJOR SYSTEMS P(k/h) VALUES FOR 100 
GROUPING GRAIN FRAGMENT @ 4000 FPS 
(uninstalled) 


Hydraulics Systems 
No. 1, 2 and Backup-cont. 


Right Rudder Actuator Шал 
tere Stabalater Actuator 015512 
Right Stabilator Actuator 0235 
Left Aileron Sensing Valve 0.6 

Right Rudder Sensing Valve o 

Right Stabilator Sensing Valve 02215 
Fuel System Fire/Explosion 

Left Fuel System Ullage Ons 

Fuel in Motive Flow Lines 0.8 

Fuel in Wing Tanks 04 

Fuel in Forward Feed Tank 0.2 

Fuel in Aft Transfer Tank 0.25 
Wing Tank Ullage ОЮ б 
Longitudinal Transfer Tank Ullage O. 65 
Flight Controls--Electrical 

AFCS No. 1 (gyro stabilizer, accel- Ong 

erometer, rate/motion sensor) 

AFCS No. 2 (gyro stabilizer, accel- 973 

erometer, rate/motion sensor) 

AFCS Channel 1A 04 5 

AFCS Channel 1B 20-25 

AFCS Channel 2A T5 

ARCS Ghannel 2B 95 

Generator No. 1 Оқыр 

Battery O 

Essential DC Bus No. 1 0.45 
Essential AC Bus Or 


ТЭЭ 


TABLE 7.5 (сопс.) CRITICAL COMES РТТ 
BY MAJOR SYSTEMS GROUPING 


MAJOR SYSTEMS P(k/h) VALUES FOR 100 
GROUPING GRAIN FRAGMENT @ 4000 FPS 
(uninstalled) 





Flight Controls Mechanical 


Longitudinal Stability Cables 0:25 
Directional Stability Linkages or 3 
Lateral Stability Cables 0.4 
шэг 

Middle Canopy Frame Support 6-25 
Forward Longerons 0.15 
Aft Longerons 0. 355 
Left Wing inboard Spar Caps . 0.2 
Right Wing Outboard Spar Caps ND 
Crew Member 

Pilot ДЕО 
Armament/Weapons System 

Missile Motor 0.8 
Missile Warhead 7270 
Cannon Ammo Drum 0.6 
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aircraft's survivability. They are a measure of the prob- 
ability of component kill when impacted by a fragment. 
Normally, the P(k/h) functions are listed as a 2-axis graph 
(see Figure 3.7), relating the damage mechanism's size and 
velocity at impact. For example (from Figure 3.7), the 
P(k/h) value for a 120 grain fragment travelling at 4000 
feet per second is 0.62. This method of analysis involves 
many man-hours at test facilities for ballistic testing of 
the projectile and resultant component damage. The P(k/h) 
values determined from these functions are computed for the 
uninstalled component and are employed for all attack 
directions and impacts anywhere on the component. 

For this case study the presentation of assessment 
methodology is the goal. For this reason, the list of 
critical components has a respective P(k/h) value, not 
function, assigned to each component. These values are 
for generic components and are not based on any actual 
aircraft. They are based on the assumption of the 
uninstalled component being struck by a single fragment at 
a velocity of 4000 feet per second (fps). These values 
will be used as the starting point or baseline values in 
the vulnerability assessment. The location of the 
component inside the system and the aircraft structure has 
a definite influence on its ultimate numerical value for 
ера амо kill given a hit. Component sand structural 


shielding reduces the velocity of the damage mechanism 


r57 


апЯ аз such its lethality. This results in a change in the 
P(k/h) values for the components used in the assessment. 
This change, and the detailed reasoning behind it, will ре 
described in the vulnerability assessment in the next 


chapter. 
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ут 121200 0НЕКАВТ ТРГҮ АЗ5ЭЕББМЕМТ 


The vulnerability assessment of the A-20 will be the 
final survivability program task performed in this case 
study. The methodology for this assessment is found in 
нарсее 5 Of Ва ее 2 рев 221]. Ball presents all 
the possible techniques and situations for vulnerability 
assessment, ranging from single hit vulnerability for.a 
non-explosive penetrator or fragment (pages 158-158), to 
multiple hit vulnerability (pages 169-180), to vulnerabil- 
ity to internally and externally detonating warheads (pages 
183-191). 

This assessment of the A-20 will determine the air- 
craft's vulnerability to a single fragment. The damage 
mechanism used is the 100 grain fragment from the SA-X, the 
same one that the uninstalled P(k/h) values are based on. 
The methodology used for the single hit vulnerability is 
essentially the same as that used by the computer programs 
FASTGEN and COVART [Ref. 2:pp. 192-195]. Іп these pro- 
grams, the single hit vulnerable area of the aircraft and 
it's components can be assessed from 26 different aspects 
(Figure 8.1). For the A-20 assessment, the 45 degree azi- 
muth and 45 degree elevation aspect (Figure 8.2) will be 
used to show the methodology involved in obtaining numeri- 


cal values for the single hit vulnerability of the A-20. 
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The Aircraft Assessment Aspects 


Figure om] 
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Figure 8,2  A-20 Assessment Aspect 
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In order to simulate the FASTGEN/COVART computer analy- 
515, а grid with sections measuring 5 feet by 5 feet is 
superimposed over the A-20 (Figure 8.3). Each 5 foot by 5 
foot section is subdivided into 25 one square foot cells to 
provide a uniform grid cell area to work from. A shotline 
is randomly located in each of the one square foot cells. 
These shotlines will be followed as they travel completely 
through the aircraft. 

For the sake of simplicity, just three shotlines will 
be examined in detail (Figure 8.3). These shotlines illus- 
trate the different types of component situations that may 
be encountered when doing a single hit vulnerability asses- 


sment on-an aircraft. These situations are: 


1. Nonredundant components with overlap. (shotline 1) 
2. Redundant components with no overlap. (shotline 2) 


3. Redundant components with overlap. (shotline 3) 


Figures 8.4 through 8.9 show the shotlines passing through 
the various critical components. Table 8.1 is the list of 


components that lie on each shotline. 


A. VULNERABILITY CALCULATIONS 

For each shotline situation assessed, the component 
presented area is the area of one cell in the grid, i.e. 
one square foot (1 ft.^). The P(k/h) values of the com- 


ponents will be affected by their location within the 
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Figure 8.3 A-20 Shotline Grid 
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Fuel System Shotline Intercepts 


Figure 22224 
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Figure 8,5 Hydraulic System Shotline Intercepts 


Jo 








1 
Figure 8.7 Propulsion System Shotline Intercepts 
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Figure 8.8 Armament System Shotline Intercepts 
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Figure 8.9 
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CRITICAL COMPONENTS INDERSECTEDEOSUISNSSINES 


Shotline No. 1 


Pilot 

Mechanical Stabilator Linkage 
Right Longitudinal Transfer Tank 
Forward Keel Right Longeron | 


Shotline No. 2 


Left Inlet Duct 

Forward Feed Tank 

Hydraulic Feed Line Circuit Мо. 1 
Mechanical Aileron Linkage Mechanism 
Outboard Starboard Missile Motor 
Right Longitudinal Transfer Tank 
Center Keel Right Longeron 


Shotl ine 200780, 


Aft Side Left Longeron 

Left Rudder Hydraulic Actuator 
Left Engine 

Left Fuel Vent Line 

Accessories Section 

Left Fuel System Motive Flow Line 
Mechanical Rudder Linkage 

Right Engine 

Aft Keel Right Longeron 
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адста ёе. “As will be seen, the P(k/h) values used in the 
analysis are less than the uninstalled values presented in 
the previous chapter (Table 7.5). This is because the 
lethality of each ае is based on its striking velo- 
city on the component. Due to shielding and overlap, the 
degree of lethality is inversely proportional to the dis- 
tance the fragment travels through the aircraft. In other 
words, as the fragment slows down, the resultant P(k/h) 
value for a hit component is less than its uninstalled 
value. 
i.) Definitiens 
The following definitions parallel Ball's (Беё. 
2:pp. 158-159] explanation of the variables used in a 
vulnerability assessment. Їп this assessment, everything 
is related to the cell presented area, whereas Ball 
presents the methodology based on component presented area. 
The explanations given below refine Ball's notation. 
us This subscript represents the "ith" component 
on the "cth" shotline. Іп this case study, 
не" will have the value of 1, 2 or 3, depend- 
ing on the particular cell or shotline being 


analyzed.  Shotline/cell 1 (1i) is the for- 
ward shotline (entry thru the cockpit--see 


Figure 8.5) ни поло Се 2% 21) 15 ©һе 
the middle shotline (entry thru the left in- 
let ducc). о Мо ает Сеи з (31) 15 the aft 


shotline (entry thru the left engine). 


— .>: The vulnerable area of the "ith" component on 
Бас со ос Їл ет The number that "i" re- 
presents is the number assigned to the compo- 
nent in Table 8.1. For example, from Table 


* 


Ty 


A<p > and: 


А«РО? 


Р<5/һ,>: 


р<к/һ >: 


P<S/H >: 
P<K/H >: 
A<V >. 

С 
А<Р>; 
рсБ/Н»: 
РСП ae. 


АСУ»: 


8.1, the mechanical stabilator hinge is іп- 
tersected by shotline 1. The vulnerable area 
of the hinge is defined by the symbology 


Asus 


The presented area of each cell. As mention- 
ed earlier, this value is a constant 
at 1.0 square feet. 


The probability of the "ith" component on the 
"cth" shotiline Surviving, o vyen a hit on ENIS 
component. 


The probability of the "ith" component on the 
"eth" shotline being killed given a hit on 
this component. These values are also known 
as the installed P<k/h> values. 


The probability of Chegamecrartl surviving 
given a hit on the "cth" cell. 


The probability of the aircraft being killed 
given a hit on the "Cthitecelll . 


The Vulnerabwerarea Of у ше ЕВ: 


The presented area of the entire aircraft. 
Using Figure 8.2 this was determined to be 
399.0 square feet. 


The aircraft probability of survival given a 
random hit on the aircraft. 


The aircraft probability of kill given a 
random hit on the aircraft, 


The total single hit vulnerable area of the 
aircraft, relative to the presented aspect. 
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2. Mathematical Relationships 


The following mathematical relationships will be 
used to determine the single hit vulnerability of the A-20. 
Ball (Ref. 2], presents these relationships on pages 159- 
169. For "n" components along a shotline and "N" cells on 


the aircraft: 


Р<5/Н > - (Р<в/һ-1>) (Р<в/һ-,>) ы 2 (<Р5/һ 7) (9:1) 
ВИ - M TPSK/h > (8.2) 
А<у 2 = (P«k/h. : 7) (А<р >) (9-3) 
БАН = РАБ/НО» (8.4) 
12722 = (P<K/H >) (А<Р >) (8.5) 
A<V> = А<у у> + A<V,> T ca MEE АС > (s NS 
P<K/H> = A<V>/A<P> (2-7) 
P«S/H» = 1 - P<K/H> (8.8) 


3. Nonredundant Components with Overlap (shotline 1) 


This first situation is specifically addressed by 
Ball (Ref. 2:pp. 163-166]. The components intersected by 
shotline 1 will be used to show the methodology for this 
Situation. The results of the analysis on this shotline 


Will be values for P<K/H, > and А<У.>. 
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The list of components that are intersected by 
shotline 1 are given in Table 8.1 and are also listed in 
Table 8.2. The uninstalled P<k/h> values for each of these 
components (Р<К/һ >). is given in Table 7.5 and is also 
given in Table 8.2. The P<k/h> value for the installed 
components (РеК/ћ .>) пає been estimated and is presented 
in Table 8.2. The component vulnerable are in each cell 
(АЛЕН) is equal to the P«k/h. i7 value because of the fact 
that each cell's presented area (А<р > is equal to one 


square foot. This will be true for all three situations. 


TABLE 8.2 5НЭ ЭТР 1 
NONREDUNDANT COMPONENTS WITH OVERLAP 


Component БО ns РеК/ћ і? 5 Асу ,» 


i pilot 1.0 0.9 


2. mechanical stabilator 
hinge 0.3 0.2 


3. right Тоне а а тен 
transfer tank 95515 (012 


4. forward keel right 
longeron Q5 02210 


Т $ е 
A<v > ls ın square feet 
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For this situation, the mathematics will be pre- 
sented in detail, showing equations, value substitutions, 
and methodology. The other two situations will be pre- 
sented by citing appropriate equations and values. The 
only portions that will be examined in detail in the other 
two situations are those that make each one unique. 

To determine the vulnerability measures of the air- 
CI os given a hit on cell 1, the following methodology is 
followed: 

Using Eqns. (8.1) and (8.2) and the data given in Table 
8.2, the value for P<S/H,> is determined from 
P<S/H,> = (1 - P«k/h4 42) (1 З Р<К/В. >>) (1 = Р«К/П, 32) 

= P<k/N, >) - 
Substituting the values for P<k/h, ;> from Table 8.2 into 
the expression for P<S/H,> gives 
Eye 11(17-0-2)(1--00:3)(1 - 0.1) 


0.050. 


Using Eqn. (8.4) to determine the probability of killing 
the aircraft given a hit on cell 1 gives 


P<K/H, > ш 1 - P<S/H,> 


ше 0.05 


075757 
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Equation (8.5) is used to determine the vulnerable area 
of cell 1. This value will be used later to determine 
the A«V» of the aircraft and the P«K/H» of the aircraft. 
According БО ЕСП Ут вою 


А<у у> 


(P<K/H, >) (A<P, >) 


(0.950) (1.0 ft.^) 


0.950 ft.^ 


The only difference between the A-20 assessment 
given here and Ball's approach is that Ball [Ref. 2] uses 
the total presented area of the component to determine the 
component vulnerable area. However, this шаа (which 
is equivalent to the computerized procedure) treats each 
cell as a unique "component". Eventually, the total vulner- 
able area of each component is computed as the sum of the 
component vulnerable areas on each cell. 

This first situation resulted in a high value for 
the Р<Қ/Н.>. This value reflects the lack of component 
redun- dancy in this part of the aircraft. The next 
situation, redundant components with no overlap, shows how 
redundancy can reduce the P<K/H > value. 

4. Redundant Components with No Overlap (shotline 2) 

This second situation is addressed by Ball [Ref. 
2:pp. 166-168]. Table 8.3 presents the components 
intersected by shotline 2 and their uninstalled P<k/h> 


values. E 
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TABLE  ЭШЭНОӨТЇРМЁ?2 
REDUNDANT COMPONENTS WITH NO OVERLAP 


1 
а mE Um 
Ае и е С met 085 0.4 
2. forward feed tank 0.2 0.15 
(fire/explosion) 


2a. cascade effect--forward 
feed tank penetration 
result: hydraulic ram 
and left engine kill --- 07225 


3. hydraulic feed line cir- 
cuit no. 1 (Redundant) 0:5 Ons 


4. mechanical aileron link- 
age mechanism RS 057% 


5. outboard starboard mis- 
Se motor 0.8 0.5 


6. right longitudinal trans- 
fer tank 0.55 0.20] 


7. center keel right lon- 
geron (Redundant) 0:15 02-05 


1 : | 
AN 15 іп square feet. 


These components will be used to assess the effect 
of redundancy in components and also to show the effect 
of cascading damage [Ref.2: pp. 165-166]. Component re- 
dundancy has a significant effect on the values of 
Р<5/Н„> апа A<V,>. А single hit on the cell will not kill 


enough of the redundant components to cause a kill of the 


aircraft. (The theory and logic behind this statement is 
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shown by Ball on pages 167-168, Eqns. (5.22a-d). This 
results in the redundant components not being a factor 
in the calculations for the aircraft's vulnerability 
measures. 

Cascading damage also has a significant effect on 
the aircraft's vulnerability. This is a type of damage to 
a component not actually hit by the damage mechanism but 
that is damaged due to the response of the hit component. 
This damage may or may not be severe enough to cause a 
loss of the aircraft. This cascading effect will be ill- 
ustrated by examining the consequences of the hit on the 
forward feed tank, component 3. 

The cascading effect of forward feed tank's damage 
essentially "creates" another critical component. In this 
Situation, the fuel tank can be killed by a fire/explosion 
With a P«k/h» of 0.15 as shown in Table 8.3. The cascade 
effect occurs when the fuel tank is hit and hydraulic ram 
causes it to weaken structurally to the point where fuel 
leaks from the tank into the left inlet duct and is ingest- 
ed by the engine. This in turn causes a kill of the engine 
and hence the aircraft. The probability that this occurs 
is found ва ре 0.25 (таре 5) 

Since the engine is not located along this shot- 
line, P<k/h_ > and Асу ы values for the "created" com- 
ponent must be determined for this situation using the 


P<k/h> data and Ball's methodology on pages 163-165. The 
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aircraft can survive the hit in the fuel tank if there is 
neither a fire kill or a fuel ingestion kill of the engine. 
The probability that neither of these will occur is found 
Једи ле Eqn. (8.2). The product of the probability 
that there is no fire, (1 - 0.15), and the probability that 
there is no fuel ingestion kill of the engine, (1 - 0.25), 
is 0.64. Therefore, the probability of kill of this 
"created" component considering the cascading effect is 

(1 - 0.64) = 0.36. Thus, by accounting for the cascading 
effect of the fuel tank damage a critical component is 
"created" for this situation whose probability of kill is 
greater than either of the components that contributed to 
its creation. 

The analysis of this situation will be presented in 
two parts. The first part will show the effects of the 
cascading damage on the P<K/H,>, апа А<У.> values. The 
second part will show how the values change without the 
cascading damage being a factor. 

The values for Р<5/Н,>, Р<К/Н.> апа АсУ,» for the 
redundant and cascading situation are calculated using the 
same methodology and equations (8.1 thru 8.5) as in the 
first situation. For the cascading damage problem, only 
six components (1, 2, 2a, 4, 5 and 6) are used to determine 
the vulnerability values. As shown in Table 8.3, compo- 


nents 3 and 7 are redundant and do not contribute to the 


aircraft's single hit vulnerability (Note, however, that 
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every component, redundant or not, has a vulnerable area as 


given in Table 8.3). 


The computed values for redundancy and cascading damage 
Without overlap are as follows: 


PXS/H,» = (1 = ja p o is h eons ВІВ n о 


(1 - 0.2) see (8.1) 


02120108 


(The product of the second and third terms in 
the above equation equals 0.64. From Eqn. 
(8.1), (1 - 0.64) equals 0.36, the value of 
the P<k/h> of the "created" critical compo- 


nent.) 

P<K/H,> = 1 - 0.138 see (8.4) 
= 0.862. 

Асу,» = 0.979 ft. see (8.5) 


For comparative purposes, the following values were com- 
puted as if component redundancy did not exist in the 
above situation: 


P<S/H.> = 0.092. see (8.1) 
P<K/H,> = 0.908. see (8.4) 
A<V,> = 0.908 а see (8.5) 


be seen 


ability 


uation, 


From this simple comparative example shown, it can 
that component redundancy does decrease the prob- 
of aircraft kill given a піс іп селі 

If cascading damage was not considered in this sit- 


then the engine kill is not considered and the 
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ПО АЛМА СИА Атини. 25) у у Сне ехриеєєтоп ГОГ Р<5/Н„> ре- 
comes unity. Calculations of the vulnerability values for 
both the redundant and nonredundant situations (for 
comparative purposes) follow. 

The non-cascading redundant component calculations use 


only components 1, 2, 4, 5 and 6 (As labeled in Table 
5223: 


Р<5/Н>> = 0.184. see (8.1) 
P<K/H.> = 0.816. see (8.4). 
A<V.> = 0.816 ft. see (8.5) 


The non-cascading nonredundant component calculations 
gexcomponencs 1, 2, 3, 4, 5, 6 and 7: 


Р<5/Н„> = 0.122. і see (8.1) 
РСК/Н,» - 0.878. see (8.4) 
А<У>> = 0.878 ft. see (8.5) 


These analyses show the importance of properly con- 
Sidering cascading damage and component redundancy. By 
eliminating the cascading damage problem, the survivability 
of the aircraft if hit in this cell increases significantly 
(P<S/H,> of 0.184 vice 0.122). This is a design considera- 


tion that will be discussed later in this chapter. 
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5. Redundant Components with Overlap (shotline 3) 


The final situation discussed is where redundant, 
overlapping components occur along the same shotline (shot- 
line 3). Table 8.4 provides the components as intersected 
by shotline 3. Ball [Ref. 2], addresses this situation on 
pages 168-169 of his text. Specifically, Eqns. (5.22a) and 
(5.22b) [Ref. 2:p. 167] show how redundancy and overlap are 
handled. In this situation, a single hit in the overlap 
region has the probability of killing both engines. 

The calculations that follow exhibit the method- 
ology required for this situation. Comparative values are 
also computed to show the probabilities if there was no 
overlap in the region. 

The methodology for calcio in the vulnerability 
values is very similar to that displayed in the first two 
situations. The difference is noticed when accounting for 
the redundant, overlapping engines. This is handled by 
applying Ball's Eqn. (5.22b) [Ref. 2:p. 167] to the en- 


gines and the author's Eqns. (8.1) and (8.2) as follows: 
Р<5/Н.> = (1 - (Р«СК/П, 4,2) (P«k/h4,,2)) (1 = Р<К/ћ. д>) 


m P«k/h, £2) (1 = P<k/h, >) (1 = Р<К/һ.->) 


(lS P«k/h., 2). 
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TABLE 8.4 


Component 


ЭЦМ ЕЗ 
REDUNDANT COMPONENTS WITH 


„паж side left longer- 
on (Redundant without 
Overlap) 


2. left rudder hydraulic ac- 
жиасог 


3. left engine (Redundant 
with Overlap) 


А КОЗГЕ тага fuel vent line 
5. accessories section 


6. left fuel system motive 
flow line 


7. mechanical rudder linkage 


8. right engine (Redundant 
with Overlap) 


9. Af 2-1 right longer- 
on (Redundant without 
Overlap) 


Л . з 
BST mw Share fee 
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‚ ШО) 


Note that components 1 and 9 are not included in these 
calculations because they are redundant (with other com- 
ponents not on the shotline) and do not overlap. The 
vulnerability values are as follows: 


Р<5/Н.> = (1 =- (0,257 (0, І5уу (ЕМ 0 асан 
(ЕР = Оо. | see (8.1) 
= 0.098. 
Р<К/Н.> = 1 - 0.098 see (8.4) 
= 0.902. 
А<У.> = 0.902 ft.* see (8.5) 


If the shotline did not not intersect the two redundant, 
overlapping components, the method of calculation is the 
same as in the second situation discussed, redundant com- 
ponents without overlap. The comparative calculations 
are as follows: 


Р<5/Н.> - 0.101. see (8.1) 
Р<К/Н.> = 0.898. see (8.4) 
А<У.> = 0.898 ft.^ see (8.5) 


With redundancy and no overlap, the aircraft's 
chances of survival increase from 0.098 to 0.101. The 
overlap area has a definite detrimental affect on the air- 


craft survivability from this aspect being assessed. 
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e mmOvera1ll АМ саг survivability 
Equations (8.6), (8.7) and (8.8) provide the math- 


ematical relationships needed to determine the overall vul- 


Merable area and probability of “survival. 


From the aspect presented in Figure 8.2, the value for N 
in Eqn. (8.6) is 449 cells. For the sake of brevity, the 
A<V> of the aircraft was estimated to be 

2 2 2 


A<V> Е о: r 0.902 yt. АУ, MEE 


DEL А<У > 
^ (estimate for methodology) 


300.0 ft. 
The P<K/H> is determined from Eqn. (8.7). “he aircraft's 
A<P> = 399.0 square feet. 


P<K/H> = A<V>/A<P> 
2 


300.0 ft.2/399.0 ft. 


2212. 


The P<S/H> of the A-20 is calculated by using Eqn. (8.8): 


P<S/H> = 1 - P<K/H> 
= 1 - 0.752 
= 0.248. 


These values may not seem to be very realistic, 
nor are they necessarily intended to be. As has been ге- 
peatedly stated throughout this case study, all values used 
are based on the author's desire to present the assessment 
in a clear, concise and unclassified manner. This case 


study is meant to show the methodology involved in 
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conduct mo a vulnerability assessment, not to determine 


actual, viable vulnerability values. 


В. VULNERABILITY REDUGDION FEATURES 

The remainder of this chapter briefly discusses several 
of the vulnerability reduction features that Ball presents 
in his text [{Ref. 2:pp. 199-221] апа how they relate to the 
A-20 and this assessment. 

l. The tuci Sy tem 

The A-20 does have some vulnerability reduction 

features inherent in it's design, such as foam in the wing 
tanks, fuel feed line redundancy, motive flow, a "get home 
fuel" compartment in the main feed tank and the majority of 
the plumbing on the interior of the tanks. The A-20's 
greatest fuel system design flaw is the location of the the 
fuel tanks. Ball [Ref. 2], presents an analysis of this 
problem on pages 203-204. The A-20's longitudinal transfer 
tanks present too much exposed surface area; and as seen 
from the single hit vulnerability assessment, the forward 
feed tank is located in a position where engine fuel inges- 
tion caused by fragment penetration can have catastrophic 
results. 

2. The Propulsion System 

The A-20's propulsion system does have redundancy 

in the engines and mounting system. The major flaw in it's 


design is with it's location adjacent to a fuel tank (See 
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Бе 2002 21152175 PE he inlet duct is situated 
such that fuel ingestion with resultant engine fire is a 
possibility. On the other hand, the inlet ducts are mount- 
ed in such a fashion that they are shielded from ground 
fire. 
3. трен еј Control System 

The A-20's flight control system is multiply redun- 
dant. It is unusual in that it has a complete mechanical 
backup to the AFCS. The component placement of the hydrau- 
lic reservoirs which store the fluid to actuate the flight 
control surfaces is a weakness of the A-20 design. The 
main reservoirs are located beneath the engines with the 
majority of surface area vulnerable to ground fire. Ball 
[Ref. 2:pp. 199-200] writes about the positioning of crit- 
ical components to where they are shielded and kept away 
from any component that might contribute to cascading 
damage, such as hydraulic fluid finding its way onto the 
hot engine. 

4. The Crew System 

The A-20 carries no armor for the pilot (See Ball 
[Ref. 2:pp. 220-221]). For the type mission it is designed 
for, armor might be a viable tradeoff to reduce the pilot's 
installed P<k/h>. The cockpit location in ae vertical 
plane is also a design feature that needs some work. The 


height at which the pilot sits presents more exposed body 
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surface area than desired. There is room to lower the 
cockpit in the design configuration. | 

All of these vulnerability reduction features (and 
others), were considered when the author was performing a 
second iteration on the A-20's design. The second itera- 
tion of the A-20 is shown in Figure 8.10. Notice how the 
intake has been moved aft, away from the forward fuel tank 
and also the possibility of cannon exhaust ingestion. The 
cockpit has been lowered, and, although not visible, there 
are spall shields in the cockpit. Part of the fuselage, 
just aft of the pilot has been more aerodynamically shaped 
to provide for better airflow to the inlets (And a possible 
reduction in the aircraft's radar cross section). This has 
also resulted in a reduction of frontal area. Another fea- 
ture worth investigating is the feasibility of 2-D nozzles 


as shown in the figure. 
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Figure 8.10 


IX. RECOMMENDATIONS 


The single hit vulnerability assessment and the steps 


leading up to it are just the first ones that are necessary 


to produce the complete methodology of a survivability 


assessment. The following are recommendations for follow 


on areas of concentration to complete this assessment: 


Л 


Produce a methodology addressing the multiple hit 
vulnerability of the A-20 [Ref. 2:pp. 169-180]. 


Determine the A-20's vulnerability to internally and 
externally detonating warheads [Ref. 2:pp. 183-191]. 


Produce a case study assessing the A-20's suscepti- 
bility (RCS, IR radiation, etc.) using Ball's 
methodology [Ref. 2:pp. 227-311]. 


Tie in both the overall vulnerability and suscepti- 
bility assessments to produce a scenario dependent 
overall survivability assessment of the A-20 (See 
Ball [Ref. “а 22152212 
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